CVA CVA Cloud & Virtualization Vulnerabilities 1 — Questions and Answers
Question 1: During a cloud environment vulnerability assessment, which service endpoint is commonly targeted to retrieve AWS credentials from an EC2 instance?
- 169.254.169.254 (Instance Metadata Service) (Correct answer)
- 10.0.0.1 (Default Gateway)
- 192.168.1.1 (Cloud Router)
- 172.16.0.1 (Internal DNS)
Correct answer: 169.254.169.254 (Instance Metadata Service)
The AWS Instance Metadata Service (IMDS) at 169.254.169.254 can expose IAM role credentials to attackers who achieve SSRF or internal access to an EC2 instance.
Question 2: What is a 'misconfigured S3 bucket' vulnerability in AWS cloud environments?
- An S3 bucket with insufficient storage capacity
- An S3 bucket with overly permissive ACLs that allow public read or write access (Correct answer)
- An S3 bucket without versioning enabled
- An S3 bucket with weak encryption keys
Correct answer: An S3 bucket with overly permissive ACLs that allow public read or write access
Misconfigured S3 buckets with public ACLs or bucket policies can expose sensitive data to the internet, making them a common source of data breaches.
Question 3: Which attack targets virtualization platforms by exploiting a guest virtual machine to gain access to the underlying hypervisor or other VMs?
- Side-channel attack
- VM escape (Correct answer)
- Privilege escalation
- Container breakout
Correct answer: VM escape
VM escape is an attack where malicious code running in a guest VM breaks out of the virtualization boundary to execute code on the hypervisor or adjacent VMs.
Question 4: What is the primary security concern with 'shared responsibility model' misunderstandings in cloud vulnerability assessments?
- Cloud providers charge more for security services
- Organizations assume the cloud provider secures everything, leaving their own configurations and data unprotected (Correct answer)
- Security tools cannot run in cloud environments
- Cloud providers do not allow penetration testing
Correct answer: Organizations assume the cloud provider secures everything, leaving their own configurations and data unprotected
The shared responsibility model delineates security duties between the provider and customer; misunderstanding it leads organizations to leave their own configurations, data, and access controls unprotected.
Question 5: Which cloud security tool is used by assessors to identify misconfigured IAM policies, open security groups, and exposed resources in AWS environments?
- Nessus
- ScoutSuite (Correct answer)
- OpenVAS
- Burp Suite
Correct answer: ScoutSuite
ScoutSuite is a multi-cloud security auditing tool that assesses cloud provider configurations, identifying IAM misconfigurations, open security groups, and excessive permissions.
Question 6: In a container security assessment, what does 'privileged container' mean and why is it a risk?
- A container with more CPU/memory allocation, reducing performance for others
- A container running with all Linux capabilities and host namespace access, enabling host compromise (Correct answer)
- A container accessible from the internet without authentication
- A container with access to encrypted secrets
Correct answer: A container running with all Linux capabilities and host namespace access, enabling host compromise
A privileged Docker container runs with all Linux capabilities and access to the host namespace, effectively allowing container escape and full host system compromise.
CVA CVA Cloud & Virtualization Vulnerabilities 1
During a cloud environment vulnerability assessment, which service endpoint is commonly targeted to retrieve AWS credentials from an EC2 instance?