CVA CVA Cloud & Virtualization Vulnerabilities 3 — Questions and Answers
Question 1: What does 'container image scanning' accomplish in a cloud security assessment?
- Monitors container runtime behavior for anomalies
- Identifies known CVEs and misconfigurations within container images before deployment (Correct answer)
- Encrypts container images at rest
- Enforces network segmentation between containers
Correct answer: Identifies known CVEs and misconfigurations within container images before deployment
Container image scanning analyzes image layers for known CVEs, outdated packages, and security misconfigurations before images are deployed to production.
Question 2: Which cloud vulnerability involves functions or services that trigger other services in an uncontrolled chain, potentially leading to infinite loops or cost exhaustion?
- Event injection
- Function chain vulnerability
- Resource exhaustion / event-driven attack (Correct answer)
- Insecure trigger configuration
Correct answer: Resource exhaustion / event-driven attack
Serverless resource exhaustion attacks exploit event-driven architectures to trigger cascading function invocations, causing denial of service or unexpected cost escalation.
Question 3: What is the purpose of testing cloud Identity Federation configurations during a vulnerability assessment?
- To verify that cloud storage is encrypted
- To identify trust relationships that could allow external identity providers to grant unauthorized cloud access (Correct answer)
- To assess network bandwidth between cloud regions
- To validate cloud provider SLA compliance
Correct answer: To identify trust relationships that could allow external identity providers to grant unauthorized cloud access
Identity Federation misconfigurations can allow external IdPs to grant excessive cloud permissions, enabling unauthorized access if the trust relationship is overly permissive.
Question 4: In a Kubernetes security assessment, what is the risk of an overly permissive ClusterRoleBinding?
- It slows down pod scheduling
- It grants excessive permissions to service accounts or users, potentially enabling full cluster compromise (Correct answer)
- It prevents pods from communicating across namespaces
- It disables horizontal pod autoscaling
Correct answer: It grants excessive permissions to service accounts or users, potentially enabling full cluster compromise
Overly permissive ClusterRoleBindings can grant cluster-admin or other broad roles to service accounts, allowing compromised workloads to take full control of the cluster.
Question 5: Which approach is recommended for secrets management in cloud-native applications to avoid hardcoded credentials?
- Storing secrets in Docker environment variables
- Using dedicated secrets managers like AWS Secrets Manager or HashiCorp Vault with dynamic credentials (Correct answer)
- Encoding secrets in Base64 and storing in config files
- Rotating secrets manually every 90 days
Correct answer: Using dedicated secrets managers like AWS Secrets Manager or HashiCorp Vault with dynamic credentials
Dedicated secrets managers provide centralized storage, automatic rotation, and audit logging for credentials, eliminating the need for hardcoded or static secrets.
Question 6: What security risk does 'public cloud snapshot exposure' present during a cloud vulnerability assessment?
- Snapshots consume excessive storage costs
- Public EBS or disk snapshots can be accessed by any AWS account, potentially exposing sensitive data or credentials (Correct answer)
- Snapshots cannot be restored if made public
- Public snapshots prevent backup automation
Correct answer: Public EBS or disk snapshots can be accessed by any AWS account, potentially exposing sensitive data or credentials
Public cloud snapshots (e.g., AWS EBS snapshots) can be mounted by any account, allowing attackers to extract file systems, credentials, and configuration data.
CVA CVA Cloud & Virtualization Vulnerabilities 3
What does 'container image scanning' accomplish in a cloud security assessment?