Securing Serverless Functions GPCS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of assigning a least-privilege IAM role to a serverless function?

   • ATo bypass the need for authentication when the function accesses other services
   • BTo grant the function only the permissions necessary to perform its intended tasks
   • CTo ensure the function can access all cloud resources without restrictions
   • DTo allow the function to be invoked by any user in the cloud account
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization exposes an AWS Lambda function via Amazon API Gateway. Recently, a customer's misconfigured client began sending a high volume of requests, causing increased costs and near the account-level concurrency limit. The team wants to protect the function from abuse while minimizing impact on legitimate customers. What should they do?

   • ARemove the API Gateway and expose the Lambda function directly to the internet with a public endpoint.
   • BConfigure a usage plan with a per-key rate limit and a burst quota for the API Gateway, and set a reserved concurrency limit on the Lambda function.
   • CSet the Lambda function timeout to 15 minutes to allow it to process more requests per invocation.
   • DIncrease the Lambda function's unreserved concurrency limit to handle the high volume.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which service is designed to securely store and retrieve secrets like API keys and database credentials?

   • AA public cloud storage bucket with read access for all users
   • BAn environment variable set in the function's deployment settings
   • CA configuration file stored in the function's source code repository
   • DA dedicated secrets management service (e.g., AWS Secrets Manager, Azure Key Vault)
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   During an incident, a security analyst needs to determine what data a compromised AWS Lambda function may have exfiltrated. The function had access to a database and an S3 bucket. The analyst has CloudTrail and CloudWatch Logs available. What is the most effective way to reconstruct the function's actions?

   • ACheck the S3 bucket's access logs, which are enabled by default, to see what objects were accessed.
   • BRecover the function's memory from the last invocation to see what data was processed.
   • CUse the Lambda function's last execution trace to replay the function's code and see what it did.
   • DQuery CloudTrail for API calls made by the function's IAM role, and review CloudWatch Logs for any custom logging that records data access.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A healthcare organization is deploying a serverless function that processes patient data. The data must be encrypted at rest and in transit, and the function must not retain data longer than necessary. What should the team implement?

   • AUse a third-party encryption library in the function code and store the encryption keys in the same environment.
   • BStore patient data in the function's environment variables and rely on the cloud provider's default encryption.
   • CDisable logging for the function to prevent patient data from being written to logs.
   • DUse a cloud KMS service to encrypt data at rest, enforce TLS for all data in transit, and configure the function to delete temporary files after processing.
   Reveal Solution Discussion Select an answer first