Cloud Computing Threats and Countermeasures ECSS Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which statement correctly defines the cloud computing service model known as Platform as a Service (PaaS)?

   • AA model that combines on-premises infrastructure with public cloud services to create a hybrid environment.
   • BA model that offers ready-to-use software applications accessed via a web browser, with the provider managing everything.
   • CA model that delivers a managed platform, including runtime, middleware, and development tools, for building and deploying applications.
   • DA model that provides virtualized hardware resources such as CPUs, memory, and storage over the internet.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company hosts a web application on a public cloud VM. The application makes HTTP requests to a third-party service using credentials stored in environment variables. An attacker exploits a server-side request forgery (SSRF) vulnerability in the application and accesses the cloud metadata service. What is the MOST LIKELY immediate impact?

   • AThe attacker gains read access to temporary cloud credentials associated with the VM's role.
   • BThe attacker can decrypt all data stored on the VM's attached disks.
   • CThe attacker can modify the VM's firewall rules to allow inbound traffic from any source.
   • DThe attacker can directly access the third-party service using the environment variable credentials.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a common cloud-specific threat that arises when organizations fail to properly configure their cloud resources, such as leaving storage buckets publicly accessible?

   • AInsider threat
   • BShared technology vulnerabilities
   • CAccount hijacking
   • DMisconfiguration
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company is migrating to a public cloud and wants to ensure that their security policies are consistently applied across all resources. They also need to meet compliance requirements for auditing. Which tool should they use?

   • AUse a traditional vulnerability scanner that only scans on-premises servers.
   • BUse a data loss prevention (DLP) tool to monitor data transfers.
   • CUse a network intrusion detection system (IDS) to monitor traffic.
   • DUse a cloud security posture management (CSPM) tool to continuously monitor and enforce security policies.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A startup uses a public cloud IaaS environment. After a security review, they discover that a developer accidentally left a cloud storage bucket publicly readable, exposing customer data. Which combination of controls would BEST prevent this class of incident in the future?

   • ARequire multi-factor authentication for all developer accounts and rotate access keys monthly.
   • BMove all data to a private cloud deployment model to eliminate the risk of public exposure.
   • CEnable server-side encryption on all storage buckets and enforce HTTPS-only access.
   • DImplement a policy that denies public access to storage buckets and use infrastructure-as-code scanning to detect misconfigurations before deployment.
   Reveal Solution Discussion Select an answer first