CCSK Infrastructure Security and Virtualization 2 — Questions and Answers
Question 1: What does CCSK say about the security of container images pulled from public registries?
- Public registry images are always secure because they are widely used
- Container images from public registries should be scanned for vulnerabilities and malware before use in production (Correct answer)
- Public registry images do not require security review if they are official images
- Container images are not relevant to CCSK security guidance
Correct answer: Container images from public registries should be scanned for vulnerabilities and malware before use in production
Public container images may contain vulnerabilities or malicious code and must be scanned and validated before being deployed in production environments.
Question 2: What is 'container breakout' and how does it compare to hypervisor escape?
- They are identical attacks against the same layer
- Container breakout exploits vulnerabilities to escape the container to the host OS; it is more likely than hypervisor escape because containers share the host kernel (Correct answer)
- Container breakout only affects Kubernetes environments
- Container breakout requires physical access to the host server
Correct answer: Container breakout exploits vulnerabilities to escape the container to the host OS; it is more likely than hypervisor escape because containers share the host kernel
Containers share the host kernel, making breakout more feasible than hypervisor escape; a kernel vulnerability can be exploited to gain host-level access.
Question 3: According to CCSK, what is 'infrastructure as code' (IaC) security scanning used to detect?
- Performance bottlenecks in cloud deployments
- Security misconfigurations and policy violations in infrastructure templates before deployment (Correct answer)
- Network latency issues in multi-region deployments
- Cost overruns from over-provisioned resources
Correct answer: Security misconfigurations and policy violations in infrastructure templates before deployment
IaC security scanning analyzes templates like Terraform or CloudFormation for misconfigurations, overly permissive policies, or compliance violations before they are deployed.
Question 4: What is a 'software-defined network' (SDN) and what security advantage does it provide in cloud environments?
- A physical network where security policies are written in code
- A network whose control plane is software-based, enabling dynamic, programmable security policy enforcement (Correct answer)
- A network that operates without any physical switches or routers
- A network standard for encrypting cloud traffic
Correct answer: A network whose control plane is software-based, enabling dynamic, programmable security policy enforcement
SDN separates the control plane from the data plane, allowing security policies to be applied programmatically and dynamically across the virtual network.
Question 5: According to CCSK, what is the recommended approach to patch management for cloud-hosted workloads?
- Rely on the cloud provider to patch all software
- Establish automated patching pipelines and replace rather than patch long-running instances when possible (Correct answer)
- Patch only when a critical CVE is publicly disclosed
- Manual patching is preferred for cloud workloads for better control
Correct answer: Establish automated patching pipelines and replace rather than patch long-running instances when possible
Automated patching and replacing instances with updated golden images is more reliable than manual patching and reduces the window of exposure.
Question 6: What is the security purpose of 'host-based intrusion detection systems' (HIDS) in cloud VMs?
- To monitor network traffic between cloud regions
- To detect unauthorized changes, malicious activity, or policy violations occurring within individual VMs (Correct answer)
- To replace network firewalls for cloud workloads
- To manage encryption keys on cloud hosts
Correct answer: To detect unauthorized changes, malicious activity, or policy violations occurring within individual VMs
HIDS monitors file integrity, system calls, and logs within individual VMs to detect compromise indicators that network-level monitoring cannot see.
CCSK Infrastructure Security and Virtualization 2
What does CCSK say about the security of container images pulled from public registries?