CVA CVA Cloud & Virtualization Vulnerabilities 3

Question 1

What does 'container image scanning' accomplish in a cloud security assessment?

Accepted Answer

Identifies known CVEs and misconfigurations within container images before deployment

Answer

Container image scanning analyzes image layers for known CVEs, outdated packages, and security misconfigurations before images are deployed to production.

Question 2

Which cloud vulnerability involves functions or services that trigger other services in an uncontrolled chain, potentially leading to infinite loops or cost exhaustion?

Accepted Answer

Resource exhaustion / event-driven attack

Answer

Serverless resource exhaustion attacks exploit event-driven architectures to trigger cascading function invocations, causing denial of service or unexpected cost escalation.

Question 3

What is the purpose of testing cloud Identity Federation configurations during a vulnerability assessment?

Accepted Answer

To identify trust relationships that could allow external identity providers to grant unauthorized cloud access

Answer

Identity Federation misconfigurations can allow external IdPs to grant excessive cloud permissions, enabling unauthorized access if the trust relationship is overly permissive.

Question 4

In a Kubernetes security assessment, what is the risk of an overly permissive ClusterRoleBinding?

Accepted Answer

It grants excessive permissions to service accounts or users, potentially enabling full cluster compromise

Answer

Overly permissive ClusterRoleBindings can grant cluster-admin or other broad roles to service accounts, allowing compromised workloads to take full control of the cluster.

Question 5

Which approach is recommended for secrets management in cloud-native applications to avoid hardcoded credentials?

Accepted Answer

Using dedicated secrets managers like AWS Secrets Manager or HashiCorp Vault with dynamic credentials

Answer

Dedicated secrets managers provide centralized storage, automatic rotation, and audit logging for credentials, eliminating the need for hardcoded or static secrets.

(CVA) Certified Vulnerability Assessor Practice Test

(CVA) Certified Vulnerability Assessor Practice Test

CVA CVA Cloud & Virtualization Vulnerabilities 3