Cloud Computing Threats and Countermeasures ECSS Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A penetration tester is assessing a cloud environment and discovers that the application running on a VM can access the cloud provider's metadata service. The tester wants to demonstrate the risk of this access. What is the most likely attack the tester can perform?

   • ALaunch a denial-of-service attack against the metadata service endpoint.
   • BModify the VM's security group to allow inbound traffic from the internet.
   • CPerform a cross-site scripting attack against the application to steal session cookies.
   • DRetrieve temporary IAM credentials from the metadata service and use them to access other cloud resources.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A penetration tester is performing an assessment of a cloud environment and discovers that a web application has a server-side request forgery (SSRF) vulnerability. The application is hosted on a VM with access to the cloud metadata service. What is the most critical impact the tester can demonstrate?

   • AThe tester can modify the VM's security group to allow inbound traffic.
   • BThe tester can read the VM's local file system.
   • CThe tester can perform a denial-of-service attack against the metadata service.
   • DThe tester can retrieve temporary IAM credentials from the metadata service and assume the VM's role.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A healthcare organization is planning to migrate patient records to a public cloud provider. They must comply with HIPAA and need to ensure that only authorized personnel can access the data. The organization also wants to maintain the ability to audit all access. Which approach best meets these requirements?

   • AUse a community cloud shared with other healthcare organizations to reduce costs, but do not implement additional access controls.
   • BUse a private cloud deployment model and store all data on-premises.
   • CUse a hybrid cloud with data stored in the public cloud but no encryption, relying on the provider's physical security.
   • DUse a public cloud provider that offers HIPAA-compliant services, implement strong IAM policies, and enable detailed logging and monitoring.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which cloud security countermeasure is designed to ensure that only authorized users and services can access cloud resources, typically through policies, roles, and multi-factor authentication?

   • AEncryption
   • BNetwork segmentation
   • CSecurity groups
   • DIdentity and access management (IAM)
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security analyst notices that a cloud VM is making outbound connections to a known command-and-control (C2) server. The VM's IAM role has permissions to read from a sensitive database. Which immediate action would BEST limit the impact of a potential compromise?

   • ATake a snapshot of the VM for forensic analysis and then shut it down.
   • BDetach the IAM role from the VM and isolate the VM by removing it from the network.
   • CAdd a network security group rule to block outbound traffic to the C2 server's IP.
   • DChange the database password and rotate all access keys.
   Reveal Solution Discussion Select an answer first