CVA CVA Cloud & Virtualization Vulnerabilities 2 — Questions and Answers
Question 1: What is 'lateral movement' in the context of a cloud environment breach?
- Moving data between cloud regions
- Attackers pivoting from one compromised cloud resource to access other resources within the same environment (Correct answer)
- Scaling cloud resources horizontally
- Migrating workloads between cloud providers
Correct answer: Attackers pivoting from one compromised cloud resource to access other resources within the same environment
Lateral movement in cloud environments involves attackers using compromised resources to access and exploit other resources, escalating the breach across the cloud tenant.
Question 2: Which Kubernetes misconfiguration exposes the cluster API server to unauthenticated access?
- Enabling RBAC with default roles
- Leaving the API server accessible on port 6443 without authentication (anonymous-auth=true) (Correct answer)
- Using namespaces to separate workloads
- Enabling network policies
Correct answer: Leaving the API server accessible on port 6443 without authentication (anonymous-auth=true)
Enabling anonymous authentication on the Kubernetes API server allows unauthenticated users to interact with the cluster, potentially executing privileged operations.
Question 3: During a cloud assessment, you discover that all developers share a single IAM access key with administrator permissions. What principle is violated?
- Defense in depth
- Principle of least privilege (Correct answer)
- Zero-trust architecture
- Separation of duties
Correct answer: Principle of least privilege
The principle of least privilege requires granting users only the minimum permissions needed for their tasks; sharing an administrator key with all developers violates this principle.
Question 4: What is a 'cloud storage bucket enumeration' attack?
- Deleting all files from a cloud storage bucket
- Systematically discovering publicly accessible cloud storage buckets belonging to an organization (Correct answer)
- Encrypting bucket contents with attacker-controlled keys
- Monitoring bucket access logs for suspicious activity
Correct answer: Systematically discovering publicly accessible cloud storage buckets belonging to an organization
Bucket enumeration involves systematically testing storage bucket names based on an organization's naming conventions to discover publicly exposed buckets containing sensitive data.
Question 5: Which attack exploits the multi-tenancy nature of cloud platforms to infer information about other tenants through shared hardware resources?
- Cross-tenant injection
- Side-channel attack (e.g., Spectre/Meltdown) (Correct answer)
- Tenant spoofing
- Resource exhaustion attack
Correct answer: Side-channel attack (e.g., Spectre/Meltdown)
Side-channel attacks like Spectre and Meltdown exploit shared hardware resources (CPU caches, branch predictors) in multi-tenant cloud environments to leak data across tenant boundaries.
Question 6: In assessing serverless function security (e.g., AWS Lambda), what is a key vulnerability to test for?
- Lack of operating system patching
- Insecure environment variables storing plaintext credentials (Correct answer)
- Insufficient RAM allocation
- Missing load balancer configuration
Correct answer: Insecure environment variables storing plaintext credentials
Serverless functions often store sensitive credentials in environment variables that may be exposed through verbose error messages, logs, or if the function code itself is compromised.
CVA CVA Cloud & Virtualization Vulnerabilities 2
What is 'lateral movement' in the context of a cloud environment breach?