CASP+ Cloud and Virtualization Security 1 — Questions and Answers
Question 1: In a cloud shared responsibility model using IaaS, which component is the CUSTOMER'S responsibility to secure?
- Physical data center security
- Hypervisor patches
- Guest operating system and installed applications (Correct answer)
- Network backbone infrastructure
Correct answer: Guest operating system and installed applications
In IaaS, the cloud provider secures physical hardware, hypervisors, and networking; the customer is responsible for securing the OS, applications, and data running on the virtual machines.
Question 2: Which attack targets the hypervisor layer to escape from a virtual machine and access the underlying host or other VMs?
- Container escape
- VM escape (hypervisor breakout) (Correct answer)
- Side-channel attack
- API injection
Correct answer: VM escape (hypervisor breakout)
A VM escape exploits hypervisor vulnerabilities to break out of the isolated VM environment and gain unauthorized access to the host OS or adjacent virtual machines.
Question 3: A security team is implementing cloud workload protection. Which control MOST effectively detects anomalous behavior within running containers?
- Image scanning at build time only
- Runtime container security monitoring with syscall analysis (Correct answer)
- Network-level firewall rules
- Disabling all container networking
Correct answer: Runtime container security monitoring with syscall analysis
Runtime monitoring using syscall analysis detects deviations from expected container behavior (e.g., unexpected shell execution, privilege escalation) that image scanning cannot catch.
Question 4: Which cloud security architecture pattern uses a dedicated security account/subscription to centralize logging, monitoring, and security tooling?
- Multi-tenant shared services model
- Hub-and-spoke (landing zone) with a dedicated security hub account (Correct answer)
- Single account with all workloads
- Direct peering between all workload accounts
Correct answer: Hub-and-spoke (landing zone) with a dedicated security hub account
A hub-and-spoke landing zone architecture centralizes security services (SIEM, logging, network inspection) in a dedicated hub account, providing centralized visibility without mixing workloads.
Question 5: Which technique allows organizations to verify that a cloud provider's hardware and firmware have not been tampered with before trusting the environment?
- Reviewing the provider's marketing materials
- Remote attestation using a Trusted Platform Module (TPM) and measured boot (Correct answer)
- Conducting a physical site visit
- Checking the provider's compliance certifications alone
Correct answer: Remote attestation using a Trusted Platform Module (TPM) and measured boot
Remote attestation uses TPM-stored measurements of the boot process to cryptographically prove to a remote verifier that the platform booted trusted, unmodified firmware and software.
Question 6: A company migrates a regulated workload to a public cloud. Which cloud deployment model MOST effectively addresses data sovereignty requirements?
- Public multi-region cloud with data replication globally
- Sovereign cloud or government cloud region with contractual data residency guarantees (Correct answer)
- Hybrid cloud with no data residency controls
- Public cloud with client-side encryption only
Correct answer: Sovereign cloud or government cloud region with contractual data residency guarantees
Sovereign or government cloud regions are physically and logically isolated, with contractual guarantees that data remains within a specific jurisdiction, satisfying data sovereignty regulations.
CASP+ Cloud and Virtualization Security 1
In a cloud shared responsibility model using IaaS, which component is the CUSTOMER'S responsibility to secure?