CASP+ Cloud and Virtualization Security 2

Question 1

Which Kubernetes security control prevents containers from running as the root user within a cluster?

Accepted Answer

Pod Security Admission (PSA) with restricted policy

Answer

Pod Security Admission enforces security profiles on pods; the 'restricted' policy prohibits running as root, disallows privilege escalation, and requires read-only root filesystems.

Question 2

Which cloud security control prevents accidental public exposure of storage buckets containing sensitive data?

Accepted Answer

AWS S3 Block Public Access or equivalent provider-level public access prevention

Answer

Block Public Access settings override any bucket or object ACLs that would grant public access, providing an account-level guardrail against accidental data exposure.

Question 3

A DevSecOps team wants to embed security into the CI/CD pipeline. Which control MOST effectively prevents vulnerable container images from being deployed to production?

Accepted Answer

Automated image scanning with deployment gates that block critical CVEs

Answer

Automated scanning with policy-based deployment gates ensures images with critical vulnerabilities cannot progress through the pipeline to production without explicit approval.

Question 4

Which cloud identity and access management practice MOST effectively enforces least privilege for serverless functions?

Accepted Answer

Creating a unique, minimal IAM execution role per function with only required permissions

Answer

Each function gets only the permissions it needs to perform its specific task; a compromise of one function cannot be used to access resources needed only by other functions.

Question 5

Which security mechanism protects cloud management plane credentials from being embedded in application code or configuration files?

Accepted Answer

Using cloud provider instance metadata service (IMDS) with IMDSv2 and IAM instance profiles

Answer

IAM instance profiles allow applications to obtain short-lived credentials from the IMDS without any static credentials, and IMDSv2 requires session-oriented requests to prevent SSRF-based theft.

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ Cloud and Virtualization Security 2