Cyber Security Cloud Security 2 — Questions and Answers
Question 1: What is a cloud access security broker (CASB)?
- A hardware appliance that filters cloud traffic at the data center
- A security tool that monitors and enforces policies for cloud service access (Correct answer)
- A managed detection and response service for cloud environments
- A certificate authority for cloud-hosted applications
Correct answer: A security tool that monitors and enforces policies for cloud service access
A CASB sits between users and cloud services to enforce security policies, provide visibility, and prevent data leakage.
Question 2: What is the primary risk of using the root account in AWS for daily operations?
- Root account access is slower than IAM accounts
- Root account has unrestricted access to all resources, making compromise catastrophic (Correct answer)
- Root account cannot access most AWS services
- Root account requires additional billing charges
Correct answer: Root account has unrestricted access to all resources, making compromise catastrophic
The root account has unlimited privileges including closing the account, making it a high-value target that should rarely be used.
Question 3: What does a Virtual Private Cloud (VPC) provide in cloud environments?
- A dedicated physical server in the cloud provider's data center
- An isolated network environment within the cloud for deploying resources (Correct answer)
- Automatic backups of all virtual machine data
- A managed container orchestration service
Correct answer: An isolated network environment within the cloud for deploying resources
A VPC provides an isolated, logically defined network in the cloud where you control IP ranges, subnets, and routing.
Question 4: What is infrastructure as code (IaC) security scanning used to detect?
- Malware in container images
- Misconfigurations in Terraform or CloudFormation templates before deployment (Correct answer)
- Unauthorized API calls in production
- Data exfiltration from cloud storage
Correct answer: Misconfigurations in Terraform or CloudFormation templates before deployment
IaC security scanning analyzes templates like Terraform or CloudFormation to find misconfigurations before they reach production.
Question 5: Which attack targets cloud metadata services to steal temporary credentials?
- SQL injection on RDS databases
- Server-Side Request Forgery (SSRF) targeting the instance metadata service (Correct answer)
- Cross-site scripting in cloud web apps
- Replay attacks on cloud API tokens
Correct answer: Server-Side Request Forgery (SSRF) targeting the instance metadata service
SSRF can trick cloud applications into querying the instance metadata service (e.g., 169.254.169.254) to retrieve IAM credentials.
Question 6: What is the purpose of security groups in AWS?
- Group IAM users with similar permission sets
- Act as virtual firewalls controlling inbound and outbound traffic for EC2 instances (Correct answer)
- Monitor cloud resource usage for billing purposes
- Encrypt data stored in S3 buckets
Correct answer: Act as virtual firewalls controlling inbound and outbound traffic for EC2 instances
AWS security groups function as virtual firewalls, controlling allowed inbound and outbound traffic for instances.
Cyber Security Cloud Security 2
What is a cloud access security broker (CASB)?