Virtualization and Cloud Computing Security ECSS Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A small business migrates its customer database to a cloud PaaS offering. The provider manages the runtime environment and applies OS patches, but the business is responsible for the application code and data. A data breach occurs because the application's database queries are vulnerable to SQL injection. Who is primarily responsible for this vulnerability?

   • AThe business, because they are responsible for securing their application code.
   • BThe database vendor, because SQL injection is a database flaw.
   • CThe cloud provider, because they host the application.
   • DBoth equally, because security is always shared 50/50.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company runs a Type 1 hypervisor with multiple production VMs. An administrator discovers that a VM kernel module can read host memory. Which risk is being exploited, and what immediate control should be applied?

   • ASnapshot theft; delete all snapshots of the affected VM
   • BInsecure VM migration; disable migration on the affected VM
   • CVM escape; apply the hypervisor vendor's security patch and isolate the affected VM
   • DHypervisor sprawl; consolidate VMs onto fewer hosts
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company is evaluating a SaaS email service. They want to ensure that emails are encrypted in transit and at rest. Which party is responsible for implementing encryption at rest for the email data?

   • ABoth parties are equally responsible for all encryption.
   • BThe provider, because they control the storage infrastructure.
   • CThe email recipient, because they receive the data.
   • DThe customer, because they own the data.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which cloud deployment model is characterized by infrastructure that is shared by several organizations with a common interest, such as a specific industry or compliance requirement?

   • APrivate cloud
   • BPublic cloud
   • CHybrid cloud
   • DCommunity cloud
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Why is compliance with regulations such as GDPR important when using cloud services?

   • AIt helps organizations meet legal requirements for protecting personal data.
   • BIt is optional and only recommended for large enterprises.
   • CIt ensures that the cloud provider is responsible for all data protection.
   • DIt guarantees that the cloud is immune to data breaches.
   Reveal Solution Discussion Select an answer first