Cloud and Virtualization Security Flashcards

Which control MOST effectively protects against a cloud misconfiguration that exposes an internal metadata service to a server-side request forgery (SSRF) attack?

Answer: IMDSv2 (requiring session tokens for metadata access) and network egress filtering

IMDSv2 requires a PUT request to obtain a session token before accessing metadata, preventing SSRF exploits that use simple GET requests to steal instance credentials.

A cloud security engineer reviews a multi-account AWS environment. Which service provides centralized, automated security findings aggregation across all accounts?

Answer: AWS Security Hub

AWS Security Hub aggregates findings from GuardDuty, Inspector, Majestic, and third-party tools across all accounts in an organization, providing a single security posture dashboard.

Which network control MOST effectively limits the blast radius of a compromised container within a Kubernetes cluster?

Answer: Kubernetes NetworkPolicy objects restricting pod-to-pod communication to necessary paths only

NetworkPolicy objects define ingress and egress rules for pods; a compromised pod with restrictive policies cannot initiate connections to arbitrary pods in other namespaces.

Which cloud logging source MOST directly captures attempted privilege escalation in an AWS environment?

Answer: AWS CloudTrail with management event logging for IAM and STS API calls

CloudTrail records every IAM and STS API call, including AssumeRole, CreatePolicy, and AttachUserPolicy, directly revealing privilege escalation attempts in the management plane.

An organization encrypts cloud storage with customer-managed keys (CMK). Which action allows the cloud provider to render the data inaccessible without deleting it?

Answer: Disabling or scheduling deletion of the CMK in the KMS

Disabling or scheduling deletion of the CMK prevents the cloud provider's encryption service from decrypting data; the ciphertext remains but is cryptographically inaccessible without the key.

Which security practice MOST reduces the risk of secrets sprawl in a cloud-native CI/CD environment?

Answer: Using a centralized secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) with dynamic secret generation

Centralized secrets managers with dynamic, short-lived credentials ensure secrets are never stored statically, are automatically rotated, and all access is audited.