Cloud Vulnerability Analysis GCTD Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security engineer needs to scan a Kubernetes cluster running on Google Kubernetes Engine (GKE) for misconfigurations and vulnerabilities. The engineer wants to use a tool that is integrated with the cloud provider and can scan both the cluster configuration and container images. Which tool should they use?

   • Akube-bench
   • BTrivy
   • CGoogle Cloud Security Command Center
   • DAqua Security
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A vulnerability scan of an Azure subscription reveals the following findings: (1) a public-facing web app with a critical RCE vulnerability, (2) an internal VM with a high-severity privilege escalation vulnerability, and (3) a storage account with a medium-severity misconfiguration that allows public blob access. The web app is internet-facing and processes sensitive customer data. Which vulnerability should be remediated first?

   • AThe public-facing web app RCE, because it is internet-exposed and has critical severity.
   • BThe storage account public blob access, because it is a misconfiguration.
   • CThe internal VM privilege escalation, because it has high severity.
   • DAll three simultaneously, because they are all vulnerabilities.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A DevOps team deploys a containerized application on Amazon EKS. The security team wants to scan the container images for known vulnerabilities before they are deployed to production. Which solution best fits this requirement?

   • AUse Amazon Inspector to scan the EKS cluster's running workloads.
   • BRun a network vulnerability scan against the EKS cluster's node IPs.
   • CIntegrate a container image scanner like Trivy or Clair into the CI/CD pipeline.
   • DEnable AWS Config rules to detect insecure EKS cluster settings.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team has identified the following vulnerabilities in a cloud environment: (1) a critical vulnerability in a public-facing web application that is not currently exploited, (2) a high-severity vulnerability in an internal database that is actively being exploited, and (3) a medium-severity vulnerability in a development environment. The team has limited resources. Which vulnerability should be prioritized?

   • AThe medium-severity vulnerability in the development environment
   • BAll three should be remediated simultaneously
   • CThe critical vulnerability in the public-facing web application
   • DThe high-severity vulnerability in the internal database that is actively exploited
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a common remediation strategy for a vulnerability in a cloud application's code?

   • AUpdating the application to a patched version
   • BApplying a security patch to the operating system
   • CRotating API keys
   • DChanging the network firewall rules
   Reveal Solution Discussion Select an answer first