Cloud and Virtualization Security Flashcards

In a cloud shared responsibility model using IaaS, which component is the CUSTOMER'S responsibility to secure?

Answer: Guest operating system and installed applications

In IaaS, the cloud provider secures physical hardware, hypervisors, and networking; the customer is responsible for securing the OS, applications, and data running on the virtual machines.

Which attack targets the hypervisor layer to escape from a virtual machine and access the underlying host or other VMs?

Answer: VM escape (hypervisor breakout)

A VM escape exploits hypervisor vulnerabilities to break out of the isolated VM environment and gain unauthorized access to the host OS or adjacent virtual machines.

A security team is implementing cloud workload protection. Which control MOST effectively detects anomalous behavior within running containers?

Answer: Runtime container security monitoring with syscall analysis

Runtime monitoring using syscall analysis detects deviations from expected container behavior (e.g., unexpected shell execution, privilege escalation) that image scanning cannot catch.

Which cloud security architecture pattern uses a dedicated security account/subscription to centralize logging, monitoring, and security tooling?

Answer: Hub-and-spoke (landing zone) with a dedicated security hub account

A hub-and-spoke landing zone architecture centralizes security services (SIEM, logging, network inspection) in a dedicated hub account, providing centralized visibility without mixing workloads.

Which technique allows organizations to verify that a cloud provider's hardware and firmware have not been tampered with before trusting the environment?

Answer: Remote attestation using a Trusted Platform Module (TPM) and measured boot

Remote attestation uses TPM-stored measurements of the boot process to cryptographically prove to a remote verifier that the platform booted trusted, unmodified firmware and software.

A company migrates a regulated workload to a public cloud. Which cloud deployment model MOST effectively addresses data sovereignty requirements?

Answer: Sovereign cloud or government cloud region with contractual data residency guarantees

Sovereign or government cloud regions are physically and logically isolated, with contractual guarantees that data remains within a specific jurisdiction, satisfying data sovereignty regulations.