CREST CREST Cloud & Infrastructure Security 1 — Questions and Answers
Question 1: In the cloud shared responsibility model (AWS), who is responsible for patching the guest operating system on an EC2 instance?
- AWS
- The customer (Correct answer)
- The cloud service provider and customer jointly
- A third-party managed service provider automatically
Correct answer: The customer
Under the AWS shared responsibility model, AWS manages the underlying infrastructure, but customers are responsible for patching and securing their guest operating systems on EC2.
Question 2: Which attack technique involves exploiting overly permissive IAM roles or policies in AWS to escalate privileges?
- SQL injection
- IAM privilege escalation via misconfigured roles or policies (Correct answer)
- Cross-Site Request Forgery
- ARP spoofing
Correct answer: IAM privilege escalation via misconfigured roles or policies
Overly permissive IAM policies (e.g., iam:PassRole, sts:AssumeRole) can be exploited by attackers to escalate privileges or assume higher-privileged roles within AWS.
Question 3: What security risk does an exposed AWS S3 bucket with public read permissions present?
- It allows unauthorized code execution on AWS Lambda
- It exposes stored data to the public internet, potentially leaking sensitive files (Correct answer)
- It allows modification of AWS IAM policies
- It enables SSRF attacks on EC2 metadata
Correct answer: It exposes stored data to the public internet, potentially leaking sensitive files
Publicly accessible S3 buckets expose all stored objects to anyone on the internet, leading to data breaches involving credentials, backups, customer data, and source code.
Question 4: What is Server-Side Request Forgery (SSRF) in a cloud context and why is it particularly dangerous on AWS?
- An attack forging SSL certificates on web servers
- An attack that tricks a server into making requests to internal resources, including the AWS metadata endpoint (169.254.169.254) to steal IAM credentials (Correct answer)
- Cross-site scripting targeting server-side templates
- DNS rebinding targeting cloud load balancers
Correct answer: An attack that tricks a server into making requests to internal resources, including the AWS metadata endpoint (169.254.169.254) to steal IAM credentials
SSRF in AWS can be used to query the EC2 instance metadata service (169.254.169.254), retrieving temporary IAM credentials that grant the attacker cloud access.
Question 5: Which cloud security principle recommends giving users and services only the minimum permissions needed to perform their function?
- Defense in depth
- Principle of least privilege (Correct answer)
- Zero trust networking
- Security by obscurity
Correct answer: Principle of least privilege
The principle of least privilege limits IAM roles, user permissions, and service accounts to only the specific permissions required for their function, reducing blast radius from compromise.
Question 6: What does a CREST assessment of containerized infrastructure (Docker/Kubernetes) typically examine?
- Only web application vulnerabilities within containers
- Container escape vulnerabilities, privileged container misconfigurations, exposed Docker sockets, and RBAC weaknesses in Kubernetes (Correct answer)
- Only network-level security between pods
- Licensing compliance of container images
Correct answer: Container escape vulnerabilities, privileged container misconfigurations, exposed Docker sockets, and RBAC weaknesses in Kubernetes
Container security assessments focus on privileged containers, exposed Docker sockets, image vulnerabilities, Kubernetes RBAC misconfigurations, and container escape techniques.
CREST CREST Cloud & Infrastructure Security 1
In the cloud shared responsibility model (AWS), who is responsible for patching the guest operating system on an EC2 instance?