Virtualization and Cloud Computing Security ECSS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A developer exposes a cloud API without authentication, allowing anyone to call it. Which cloud threat is this, and what is the best countermeasure?

   • AMisconfiguration; disable the API
   • BData breach; encrypt all data in transit
   • CDenial of service; add rate limiting
   • DInsecure API; implement strong authentication and access controls
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A large enterprise runs a private cloud on a Type 1 hypervisor. They must maintain high availability for a critical application. The application runs on two VMs in an active-passive cluster. The administrator needs to apply a critical security patch to the hypervisor, which requires a reboot of the host. The cluster supports live migration. What is the most secure approach that maintains availability?

   • AApply the patch without rebooting, as hypervisor patches do not require reboots.
   • BTake a snapshot of the host before patching, then reboot and roll back if issues occur.
   • CLive-migrate both VMs to another host, apply the patch, and reboot the original host.
   • DShut down the passive VM, apply the patch, reboot, and then restart the passive VM.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a primary security concern when migrating a virtual machine from one physical host to another?

   • AThe VM will lose its IP address after migration.
   • BThe VM's operating system license will become invalid.
   • CThe VM's data could be exposed or tampered with during the migration process.
   • DThe hypervisor will automatically shut down after migration.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is evaluating a public cloud IaaS provider. They have a compliance requirement that all administrative access to the cloud management console must be protected by multi-factor authentication (MFA). Which party is responsible for enforcing this requirement?

   • AThe compliance auditor, because they define the requirement.
   • BThe cloud provider, because they operate the console.
   • CThe customer, because they control their user accounts and access policies.
   • DBoth parties equally, because MFA is a shared control.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is migrating to a public cloud. They have strict compliance requirements that mandate encryption of all data at rest and in transit. They also need to maintain their own encryption keys for regulatory reasons. Which approach best satisfies these requirements?

   • AStore data on-premises and use the cloud only for compute.
   • BUse client-side encryption and manage the keys in a customer-controlled key management service (KMS) or HSM.
   • CUse server-side encryption with provider-managed keys and enable TLS for transit.
   • DUse the cloud provider's default encryption and accept the provider-managed keys.
   Reveal Solution Discussion Select an answer first