Threats and Attacks in Cloud Environments CSE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which cloud attack vector is most directly associated with misconfigured storage services, such as an open Amazon S3 bucket?

   • ACompromised credentials
   • BMisconfiguration
   • CInsider threat
   • DInsecure APIs
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company's cloud application uses a third-party API for payment processing. The API documentation is public, and the company's API key is stored in a configuration file that is accidentally committed to a private repository. An attacker gains access to the repository through a separate vulnerability and extracts the API key. The attacker then uses the key to make fraudulent transactions. What is the most effective combination of controls to prevent this from recurring?

   • ARotate the API key monthly and monitor for unusual transactions.
   • BUse a secrets management service to store the API key, and implement IP allowlisting and short-lived tokens for the API.
   • CMake the repository private and restrict access to it.
   • DUse a Web Application Firewall to block requests from the attacker's IP.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company runs a multi-tenant SaaS application on a public cloud. A security researcher discovers a vulnerability in the hypervisor that could allow a VM to read the memory of other VMs on the same physical host. Which of the following is the most effective mitigation that the company can implement?

   • AEnable encryption for all VM disks to protect data at rest.
   • BMove all VMs to a dedicated physical host to eliminate the multi-tenant risk.
   • CApply the hypervisor vendor's security patch as soon as it is released and schedule a maintenance window for the affected hosts.
   • DUse a cloud access security broker (CASB) to monitor for unusual network traffic between VMs.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company stores customer data in an Amazon S3 bucket. A security audit reveals that the bucket has a bucket policy that allows 's3:GetObject' to 'Principal: *' for a specific prefix. The company wants to ensure that this data is not publicly accessible, but they still need to allow a specific partner application to read the data using its IAM role. What should they do?

   • AModify the bucket policy to allow 's3:GetObject' only to the partner's IAM role ARN, and remove the 'Principal: *' statement.
   • BRemove the bucket policy and add a bucket ACL that grants read access to the partner's IAM role.
   • CEnable S3 Block Public Access on the bucket, which will automatically allow the partner's IAM role to read the data.
   • DCreate a new IAM user for the partner and share the access keys, then update the bucket policy to allow that user.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company has experienced several security incidents due to misconfigured cloud resources. The security team wants to implement a proactive approach to detect and remediate misconfigurations before they are exploited. Which of the following is the most effective strategy?

   • AUse a cloud security posture management (CSPM) tool that continuously monitors for misconfigurations and automatically remediates them.
   • BConduct quarterly security audits of the cloud environment.
   • CProvide security training to developers on secure cloud configuration.
   • DImplement a change management process that requires manual approval for all cloud resource changes.
   Reveal Solution Discussion Select an answer first