CREST CREST Cloud & Infrastructure Security 2

Question 1

What is the primary security risk of storing secrets (API keys, passwords) in environment variables in containerized environments?

Accepted Answer

They can be exposed via container inspection, logs, crash dumps, or process enumeration by other containers

Answer

Environment variables are accessible to any process in the container and can appear in logs, crash reports, and via container inspection, making them a risky storage mechanism for secrets.

Question 2

Which attack targets the CI/CD pipeline to inject malicious code into software builds before deployment?

Accepted Answer

Supply chain attack / pipeline poisoning

Answer

Pipeline poisoning or supply chain attacks compromise CI/CD systems (GitHub Actions, Jenkins) to inject malicious code into builds, affecting all downstream deployments.

Question 3

In a Kubernetes environment, what is the risk of running pods with the 'hostNetwork: true' setting?

Accepted Answer

It gives the pod access to the host's network namespace, bypassing network policy controls

Answer

hostNetwork:true allows a container to share the host's network namespace, potentially exposing host-level services and bypassing Kubernetes network policies.

Question 4

What security concern does 'lateral movement' present in a cloud environment after an initial compromise?

Accepted Answer

An attacker can pivot from a compromised resource to access other cloud services, accounts, or data using harvested credentials or over-privileged roles

Answer

After initial cloud compromise, lateral movement allows attackers to leverage harvested credentials, assumed roles, or misconfigured trust relationships to access additional resources.

Question 5

Which AWS service provides centralized logging of all API calls made to AWS services for security auditing?

Accepted Answer

AWS CloudTrail

Answer

AWS CloudTrail records all API calls across AWS services, providing an audit trail for security investigations, compliance, and detecting unauthorized activity.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST CREST Cloud & Infrastructure Security 2