CREST CREST Cloud & Infrastructure Security 2 — Questions and Answers
Question 1: What is the primary security risk of storing secrets (API keys, passwords) in environment variables in containerized environments?
- They consume excessive memory
- They can be exposed via container inspection, logs, crash dumps, or process enumeration by other containers (Correct answer)
- They prevent container scaling
- They are not supported by Kubernetes secrets management
Correct answer: They can be exposed via container inspection, logs, crash dumps, or process enumeration by other containers
Environment variables are accessible to any process in the container and can appear in logs, crash reports, and via container inspection, making them a risky storage mechanism for secrets.
Question 2: Which attack targets the CI/CD pipeline to inject malicious code into software builds before deployment?
- SQL injection in build scripts
- Supply chain attack / pipeline poisoning (Correct answer)
- CSRF in deployment portals
- DDoS on build servers
Correct answer: Supply chain attack / pipeline poisoning
Pipeline poisoning or supply chain attacks compromise CI/CD systems (GitHub Actions, Jenkins) to inject malicious code into builds, affecting all downstream deployments.
Question 3: In a Kubernetes environment, what is the risk of running pods with the 'hostNetwork: true' setting?
- It prevents pods from accessing the internet
- It gives the pod access to the host's network namespace, bypassing network policy controls (Correct answer)
- It disables Kubernetes DNS resolution
- It exposes the Kubernetes API server to external traffic
Correct answer: It gives the pod access to the host's network namespace, bypassing network policy controls
hostNetwork:true allows a container to share the host's network namespace, potentially exposing host-level services and bypassing Kubernetes network policies.
Question 4: What security concern does 'lateral movement' present in a cloud environment after an initial compromise?
- It increases cloud infrastructure costs
- An attacker can pivot from a compromised resource to access other cloud services, accounts, or data using harvested credentials or over-privileged roles (Correct answer)
- It triggers automatic cloud provider lockout
- It only affects physical data center components
Correct answer: An attacker can pivot from a compromised resource to access other cloud services, accounts, or data using harvested credentials or over-privileged roles
After initial cloud compromise, lateral movement allows attackers to leverage harvested credentials, assumed roles, or misconfigured trust relationships to access additional resources.
Question 5: Which AWS service provides centralized logging of all API calls made to AWS services for security auditing?
- AWS Config
- AWS CloudTrail (Correct answer)
- AWS GuardDuty
- AWS Inspector
Correct answer: AWS CloudTrail
AWS CloudTrail records all API calls across AWS services, providing an audit trail for security investigations, compliance, and detecting unauthorized activity.
Question 6: What is infrastructure-as-code (IaC) scanning and why is it important in a CREST cloud assessment?
- Running antivirus on Terraform files
- Analyzing IaC templates (Terraform, CloudFormation) for security misconfigurations before deployment (Correct answer)
- Monitoring cloud infrastructure performance metrics
- Scanning container images for known CVEs
Correct answer: Analyzing IaC templates (Terraform, CloudFormation) for security misconfigurations before deployment
IaC scanning tools like Checkov and tfsec analyze Terraform and CloudFormation templates for misconfigurations (open S3 buckets, wide security groups) before they are deployed.
CREST CREST Cloud & Infrastructure Security 2
What is the primary security risk of storing secrets (API keys, passwords) in environment variables in containerized environments?