CVA CVA Cloud & Virtualization Vulnerabilities 2

Question 1

What is 'lateral movement' in the context of a cloud environment breach?

Accepted Answer

Attackers pivoting from one compromised cloud resource to access other resources within the same environment

Answer

Lateral movement in cloud environments involves attackers using compromised resources to access and exploit other resources, escalating the breach across the cloud tenant.

Question 2

Which Kubernetes misconfiguration exposes the cluster API server to unauthenticated access?

Accepted Answer

Leaving the API server accessible on port 6443 without authentication (anonymous-auth=true)

Answer

Enabling anonymous authentication on the Kubernetes API server allows unauthenticated users to interact with the cluster, potentially executing privileged operations.

Question 3

During a cloud assessment, you discover that all developers share a single IAM access key with administrator permissions. What principle is violated?

Accepted Answer

Principle of least privilege

Answer

The principle of least privilege requires granting users only the minimum permissions needed for their tasks; sharing an administrator key with all developers violates this principle.

Question 4

What is a 'cloud storage bucket enumeration' attack?

Accepted Answer

Systematically discovering publicly accessible cloud storage buckets belonging to an organization

Answer

Bucket enumeration involves systematically testing storage bucket names based on an organization's naming conventions to discover publicly exposed buckets containing sensitive data.

Question 5

Which attack exploits the multi-tenancy nature of cloud platforms to infer information about other tenants through shared hardware resources?

Accepted Answer

Side-channel attack (e.g., Spectre/Meltdown)

Answer

Side-channel attacks like Spectre and Meltdown exploit shared hardware resources (CPU caches, branch predictors) in multi-tenant cloud environments to leak data across tenant boundaries.

(CVA) Certified Vulnerability Assessor Practice Test

(CVA) Certified Vulnerability Assessor Practice Test

CVA CVA Cloud & Virtualization Vulnerabilities 2