CVA Cloud & Virtualization Vulnerabilities Flashcards

During a cloud environment vulnerability assessment, which service endpoint is commonly targeted to retrieve AWS credentials from an EC2 instance?

Answer: 169.254.169.254 (Instance Metadata Service)

The AWS Instance Metadata Service (IMDS) at 169.254.169.254 can expose IAM role credentials to attackers who achieve SSRF or internal access to an EC2 instance.

What is a 'misconfigured S3 bucket' vulnerability in AWS cloud environments?

Answer: An S3 bucket with overly permissive ACLs that allow public read or write access

Misconfigured S3 buckets with public ACLs or bucket policies can expose sensitive data to the internet, making them a common source of data breaches.

Which attack targets virtualization platforms by exploiting a guest virtual machine to gain access to the underlying hypervisor or other VMs?

Answer: VM escape

VM escape is an attack where malicious code running in a guest VM breaks out of the virtualization boundary to execute code on the hypervisor or adjacent VMs.

What is the primary security concern with 'shared responsibility model' misunderstandings in cloud vulnerability assessments?

Answer: Organizations assume the cloud provider secures everything, leaving their own configurations and data unprotected

The shared responsibility model delineates security duties between the provider and customer; misunderstanding it leads organizations to leave their own configurations, data, and access controls unprotected.

Which cloud security tool is used by assessors to identify misconfigured IAM policies, open security groups, and exposed resources in AWS environments?

Answer: ScoutSuite

ScoutSuite is a multi-cloud security auditing tool that assesses cloud provider configurations, identifying IAM misconfigurations, open security groups, and excessive permissions.

In a container security assessment, what does 'privileged container' mean and why is it a risk?

Answer: A container running with all Linux capabilities and host namespace access, enabling host compromise

A privileged Docker container runs with all Linux capabilities and access to the host namespace, effectively allowing container escape and full host system compromise.