CASP+ Cloud and Virtualization Security

Question 1

In a cloud shared responsibility model using IaaS, which component is the CUSTOMER'S responsibility to secure?

Accepted Answer

Guest operating system and installed applications

Answer

In IaaS, the cloud provider secures physical hardware, hypervisors, and networking; the customer is responsible for securing the OS, applications, and data running on the virtual machines.

Question 2

Which attack targets the hypervisor layer to escape from a virtual machine and access the underlying host or other VMs?

Accepted Answer

VM escape (hypervisor breakout)

Answer

A VM escape exploits hypervisor vulnerabilities to break out of the isolated VM environment and gain unauthorized access to the host OS or adjacent virtual machines.

Question 3

A security team is implementing cloud workload protection. Which control MOST effectively detects anomalous behavior within running containers?

Accepted Answer

Runtime container security monitoring with syscall analysis

Answer

Runtime monitoring using syscall analysis detects deviations from expected container behavior (e.g., unexpected shell execution, privilege escalation) that image scanning cannot catch.

Question 4

Which cloud security architecture pattern uses a dedicated security account/subscription to centralize logging, monitoring, and security tooling?

Accepted Answer

Hub-and-spoke (landing zone) with a dedicated security hub account

Answer

A hub-and-spoke landing zone architecture centralizes security services (SIEM, logging, network inspection) in a dedicated hub account, providing centralized visibility without mixing workloads.

Question 5

Which technique allows organizations to verify that a cloud provider's hardware and firmware have not been tampered with before trusting the environment?

Accepted Answer

Remote attestation using a Trusted Platform Module (TPM) and measured boot

Answer

Remote attestation uses TPM-stored measurements of the boot process to cryptographically prove to a remote verifier that the platform booted trusted, unmodified firmware and software.

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ Cloud and Virtualization Security