CVA Cloud & Virtualization Vulnerabilities Flashcards

What does 'container image scanning' accomplish in a cloud security assessment?

Answer: Identifies known CVEs and misconfigurations within container images before deployment

Container image scanning analyzes image layers for known CVEs, outdated packages, and security misconfigurations before images are deployed to production.

Which cloud vulnerability involves functions or services that trigger other services in an uncontrolled chain, potentially leading to infinite loops or cost exhaustion?

Answer: Resource exhaustion / event-driven attack

Serverless resource exhaustion attacks exploit event-driven architectures to trigger cascading function invocations, causing denial of service or unexpected cost escalation.

What is the purpose of testing cloud Identity Federation configurations during a vulnerability assessment?

Answer: To identify trust relationships that could allow external identity providers to grant unauthorized cloud access

Identity Federation misconfigurations can allow external IdPs to grant excessive cloud permissions, enabling unauthorized access if the trust relationship is overly permissive.

In a Kubernetes security assessment, what is the risk of an overly permissive ClusterRoleBinding?

Answer: It grants excessive permissions to service accounts or users, potentially enabling full cluster compromise

Overly permissive ClusterRoleBindings can grant cluster-admin or other broad roles to service accounts, allowing compromised workloads to take full control of the cluster.

Which approach is recommended for secrets management in cloud-native applications to avoid hardcoded credentials?

Answer: Using dedicated secrets managers like AWS Secrets Manager or HashiCorp Vault with dynamic credentials

Dedicated secrets managers provide centralized storage, automatic rotation, and audit logging for credentials, eliminating the need for hardcoded or static secrets.

What security risk does 'public cloud snapshot exposure' present during a cloud vulnerability assessment?

Answer: Public EBS or disk snapshots can be accessed by any AWS account, potentially exposing sensitive data or credentials

Public cloud snapshots (e.g., AWS EBS snapshots) can be mounted by any account, allowing attackers to extract file systems, credentials, and configuration data.