CASP+ Cloud and Virtualization Security 2 — Questions and Answers
Question 1: Which Kubernetes security control prevents containers from running as the root user within a cluster?
- Network policies
- Pod Security Admission (PSA) with restricted policy (Correct answer)
- Role-based access control (RBAC) for the API server
- TLS between kubelets
Correct answer: Pod Security Admission (PSA) with restricted policy
Pod Security Admission enforces security profiles on pods; the 'restricted' policy prohibits running as root, disallows privilege escalation, and requires read-only root filesystems.
Question 2: Which cloud security control prevents accidental public exposure of storage buckets containing sensitive data?
- Encrypting bucket contents with customer-managed keys
- AWS S3 Block Public Access or equivalent provider-level public access prevention (Correct answer)
- Enabling versioning on all buckets
- Tagging buckets with the data classification level
Correct answer: AWS S3 Block Public Access or equivalent provider-level public access prevention
Block Public Access settings override any bucket or object ACLs that would grant public access, providing an account-level guardrail against accidental data exposure.
Question 3: A DevSecOps team wants to embed security into the CI/CD pipeline. Which control MOST effectively prevents vulnerable container images from being deployed to production?
- Manual security review of all Dockerfiles
- Automated image scanning with deployment gates that block critical CVEs (Correct answer)
- Requiring developers to sign a security checklist
- Scanning images only after they are deployed to production
Correct answer: Automated image scanning with deployment gates that block critical CVEs
Automated scanning with policy-based deployment gates ensures images with critical vulnerabilities cannot progress through the pipeline to production without explicit approval.
Question 4: Which cloud identity and access management practice MOST effectively enforces least privilege for serverless functions?
- Assigning administrator roles to all Lambda/Cloud Function execution roles
- Creating a unique, minimal IAM execution role per function with only required permissions (Correct answer)
- Using the same shared execution role for all functions
- Disabling IAM for serverless functions to simplify deployment
Correct answer: Creating a unique, minimal IAM execution role per function with only required permissions
Each function gets only the permissions it needs to perform its specific task; a compromise of one function cannot be used to access resources needed only by other functions.
Question 5: Which security mechanism protects cloud management plane credentials from being embedded in application code or configuration files?
- Storing credentials in environment variables set at runtime
- Using cloud provider instance metadata service (IMDS) with IMDSv2 and IAM instance profiles (Correct answer)
- Hardcoding credentials in the application source code
- Storing credentials in a plaintext config file on the server
Correct answer: Using cloud provider instance metadata service (IMDS) with IMDSv2 and IAM instance profiles
IAM instance profiles allow applications to obtain short-lived credentials from the IMDS without any static credentials, and IMDSv2 requires session-oriented requests to prevent SSRF-based theft.
Question 6: An organization uses a cloud-native WAF to protect web applications. Which attack type is the WAF LEAST effective at preventing on its own?
- SQL injection via HTTP parameters
- Cross-site scripting (XSS) in request bodies
- Broken object-level authorization (BOLA/IDOR) (Correct answer)
- Remote file inclusion via URL parameters
Correct answer: Broken object-level authorization (BOLA/IDOR)
BOLA/IDOR is a business logic flaw where authenticated users access others' data using valid requests; WAFs cannot distinguish legitimate from malicious access to the same API endpoint.
CASP+ Cloud and Virtualization Security 2
Which Kubernetes security control prevents containers from running as the root user within a cluster?