Securing Serverless Functions GPCS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which IAM practice is most effective for controlling what a serverless function can do to other cloud services?

   • AEmbedding long-term access keys directly in the function code
   • BAssigning a dedicated IAM role with scoped policies to the function
   • CUsing the same IAM role for all functions in the account
   • DGranting the function full administrative access to simplify management
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a primary security risk associated with using third-party libraries in serverless functions?

   • ALibraries require the function to run on a dedicated server
   • BLibraries may contain vulnerabilities that can be exploited in the function
   • CLibraries automatically increase the function's memory allocation
   • DLibraries prevent the function from being triggered by events
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is using AWS Lambda to process files from an S3 bucket and then send a notification to an SNS topic. The Lambda function's IAM role currently has AdministratorAccess. The security team wants to apply least privilege. What should they do?

   • AStore the S3 and SNS credentials in the function's environment variables and use them to make API calls.
   • BCreate a new IAM role with a policy that allows only the required S3 read and SNS publish actions on the specific resources.
   • CKeep the AdministratorAccess role but add a condition that restricts the function to the specific S3 bucket.
   • DUse the function's execution role to assume a different role that has the required permissions.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A team deploys a Google Cloud Function that uses several open-source npm packages. The security team wants to reduce supply chain risk. Which approach should the team implement in their CI/CD pipeline?

   • APin dependencies to exact versions and never update them to avoid introducing new vulnerabilities.
   • BRun a software composition analysis (SCA) tool to identify known vulnerabilities in dependencies, and fail the build if any critical vulnerability is found.
   • CCopy the source code of all dependencies into the function's repository to avoid external references.
   • DUse the latest version of every package without checking compatibility or vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which practice best mitigates supply chain risks from third-party dependencies in serverless functions?

   • AUsing the latest version of every library without checking compatibility
   • BDisabling all third-party libraries to avoid risk
   • CPinning dependencies to specific, verified versions and scanning them for vulnerabilities
   • DCopying library code directly into the function to avoid package managers
   Reveal Solution Discussion Select an answer first