CCP Cloud Workload Protection 3 — Questions and Answers
Question 1: What is the significance of eBPF (extended Berkeley Packet Filter) in modern cloud workload security?
- It encrypts data at rest in cloud storage
- It enables low-overhead kernel-level visibility into workload behavior without modifying application code (Correct answer)
- It manages SSL/TLS certificate rotation
- It provides DDoS mitigation at the network edge
Correct answer: It enables low-overhead kernel-level visibility into workload behavior without modifying application code
eBPF allows security tools to observe system calls, network activity, and process behavior at the kernel level with minimal performance overhead.
Question 2: A company uses Kubernetes. Which resource defines the network traffic rules allowed between pods?
- PodSecurityPolicy
- NetworkPolicy (Correct answer)
- ResourceQuota
- ClusterRoleBinding
Correct answer: NetworkPolicy
Kubernetes NetworkPolicy resources define ingress and egress rules that control traffic flow between pods, enabling micro-segmentation.
Question 3: What is 'lateral movement' in the context of a cloud workload breach?
- Migrating workloads between cloud regions
- An attacker moving from one compromised workload to other systems within the environment (Correct answer)
- Load balancing traffic across multiple availability zones
- Rotating credentials across multiple cloud accounts
Correct answer: An attacker moving from one compromised workload to other systems within the environment
Lateral movement occurs when an attacker uses a compromised workload as a pivot point to access other systems or data within the cloud environment.
Question 4: Which cloud workload protection control BEST prevents privilege escalation attacks within a container?
- Enabling container logging
- Running containers as non-root with read-only file systems and dropped Linux capabilities (Correct answer)
- Using a shared namespace for all containers
- Allowing containers to run in privileged mode for performance
Correct answer: Running containers as non-root with read-only file systems and dropped Linux capabilities
Running containers as non-root, with read-only file systems and minimal Linux capabilities, significantly limits an attacker's ability to escalate privileges.
Question 5: In cloud workload security, what is 'drift detection'?
- Monitoring network latency between cloud regions
- Identifying changes to a workload's configuration or state that deviate from its approved baseline (Correct answer)
- Detecting data exfiltration to foreign IP ranges
- Tracking cost increases in cloud spending
Correct answer: Identifying changes to a workload's configuration or state that deviate from its approved baseline
Drift detection identifies when a running workload's configuration, files, or behavior has changed from its approved secure baseline.
Question 6: A security engineer wants to prevent a compromised container from accessing the EC2 instance metadata service. What is the MOST effective control?
- Disable the container runtime
- Block the metadata endpoint (169.254.169.254) using iptables rules or IMDSv2 enforcement (Correct answer)
- Remove all IAM roles from the EC2 instance
- Enable VPC Flow Logs
Correct answer: Block the metadata endpoint (169.254.169.254) using iptables rules or IMDSv2 enforcement
Blocking access to the metadata service endpoint prevents containers from retrieving instance credentials that could be used for further attacks.
Question 7: What is the primary security advantage of using image signing in a container supply chain?
- It compresses images to reduce deployment time
- It ensures only cryptographically verified, trusted images are deployed to production (Correct answer)
- It automatically patches known vulnerabilities in images
- It encrypts image layers at rest in the registry
Correct answer: It ensures only cryptographically verified, trusted images are deployed to production
Image signing (e.g., using Notary or Cosign) ensures integrity and authenticity so only approved images from trusted sources reach production.
CCP Cloud Workload Protection 3
What is the significance of eBPF (extended Berkeley Packet Filter) in modern cloud workload security?