CVA CVA Cloud & Virtualization Vulnerabilities 3

Question 1

What does 'container image scanning' accomplish in a cloud security assessment?

Accepted Answer

Identifies known CVEs and misconfigurations within container images before deployment

Answer

Monitors container runtime behavior for anomalies

Answer

Encrypts container images at rest

Answer

Enforces network segmentation between containers

Question 2

Which cloud vulnerability involves functions or services that trigger other services in an uncontrolled chain, potentially leading to infinite loops or cost exhaustion?

Accepted Answer

Resource exhaustion / event-driven attack

Answer

Event injection

Answer

Function chain vulnerability

Answer

Insecure trigger configuration

Question 3

What is the purpose of testing cloud Identity Federation configurations during a vulnerability assessment?

Accepted Answer

To identify trust relationships that could allow external identity providers to grant unauthorized cloud access

Answer

To verify that cloud storage is encrypted

Answer

To assess network bandwidth between cloud regions

Answer

To validate cloud provider SLA compliance

Question 4

In a Kubernetes security assessment, what is the risk of an overly permissive ClusterRoleBinding?

Accepted Answer

It grants excessive permissions to service accounts or users, potentially enabling full cluster compromise

Answer

It slows down pod scheduling

Answer

It prevents pods from communicating across namespaces

Answer

It disables horizontal pod autoscaling

Question 5

Which approach is recommended for secrets management in cloud-native applications to avoid hardcoded credentials?

Accepted Answer

Using dedicated secrets managers like AWS Secrets Manager or HashiCorp Vault with dynamic credentials

Answer

Storing secrets in Docker environment variables

Answer

Encoding secrets in Base64 and storing in config files

Answer

Rotating secrets manually every 90 days

Question 6

What security risk does 'public cloud snapshot exposure' present during a cloud vulnerability assessment?

Accepted Answer

Public EBS or disk snapshots can be accessed by any AWS account, potentially exposing sensitive data or credentials

Answer

Snapshots consume excessive storage costs

Answer

Snapshots cannot be restored if made public

Answer

Public snapshots prevent backup automation