Cloud and Virtualization Security Flashcards

Which Kubernetes security control prevents containers from running as the root user within a cluster?

Answer: Pod Security Admission (PSA) with restricted policy

Pod Security Admission enforces security profiles on pods; the 'restricted' policy prohibits running as root, disallows privilege escalation, and requires read-only root filesystems.

Which cloud security control prevents accidental public exposure of storage buckets containing sensitive data?

Answer: AWS S3 Block Public Access or equivalent provider-level public access prevention

Block Public Access settings override any bucket or object ACLs that would grant public access, providing an account-level guardrail against accidental data exposure.

A DevSecOps team wants to embed security into the CI/CD pipeline. Which control MOST effectively prevents vulnerable container images from being deployed to production?

Answer: Automated image scanning with deployment gates that block critical CVEs

Automated scanning with policy-based deployment gates ensures images with critical vulnerabilities cannot progress through the pipeline to production without explicit approval.

Which cloud identity and access management practice MOST effectively enforces least privilege for serverless functions?

Answer: Creating a unique, minimal IAM execution role per function with only required permissions

Each function gets only the permissions it needs to perform its specific task; a compromise of one function cannot be used to access resources needed only by other functions.

Which security mechanism protects cloud management plane credentials from being embedded in application code or configuration files?

Answer: Using cloud provider instance metadata service (IMDS) with IMDSv2 and IAM instance profiles

IAM instance profiles allow applications to obtain short-lived credentials from the IMDS without any static credentials, and IMDSv2 requires session-oriented requests to prevent SSRF-based theft.

An organization uses a cloud-native WAF to protect web applications. Which attack type is the WAF LEAST effective at preventing on its own?

Answer: Broken object-level authorization (BOLA/IDOR)

BOLA/IDOR is a business logic flaw where authenticated users access others' data using valid requests; WAFs cannot distinguish legitimate from malicious access to the same API endpoint.