CCSK Infrastructure Security and Virtualization 1

Question 1

What is a 'hypervisor escape' attack and why is it particularly dangerous in cloud environments?

Accepted Answer

An attack where malicious code breaks out of a VM to access the hypervisor and other VMs on the same host

Answer

Hypervisor escape allows malware from one tenant's VM to break through to the hypervisor layer, potentially accessing other tenants' VMs on the same physical host.

Question 2

According to CCSK, what is 'network segmentation' in virtual cloud environments used to achieve?

Accepted Answer

Isolating workloads to limit blast radius if one segment is compromised

Answer

Network segmentation isolates workloads so that a breach in one segment cannot easily spread laterally to other parts of the environment.

Question 3

What security benefit do 'dedicated hosts' or 'dedicated instances' provide in public cloud?

Accepted Answer

Physical isolation from other customers' workloads, eliminating multi-tenancy risks at the hardware level

Answer

Dedicated hosts provide a physical server used exclusively by one customer, eliminating the risk of cross-tenant data leakage through shared hardware.

Question 4

What is 'VM sprawl' and what security risk does it create in cloud environments?

Accepted Answer

The spread of unpatched virtual machines that are difficult to track and manage, creating unmanaged attack surfaces

Answer

VM sprawl results in orphaned, unpatched VMs that are forgotten but still running, creating entry points for attackers that are outside normal patching and monitoring.

Question 5

According to CCSK, what is a 'golden image' and how does it contribute to infrastructure security?

Accepted Answer

A hardened, pre-approved VM or container image that serves as the baseline for all deployments

Answer

A golden image is a security-hardened, pre-approved template ensuring all deployed instances start from a known secure state rather than default configurations.

CCSK - Certificate of Cloud Security Knowledge Practice Test

CCSK - Certificate of Cloud Security Knowledge Practice Test

CCSK Infrastructure Security and Virtualization 1