NSE Cloud Security & Virtualization Flashcards

What does the term 'Infrastructure as Code' (IaC) security mean in cloud environments?

Answer: Scanning and securing infrastructure definition files (e.g., Terraform, CloudFormation) for misconfigurations before deployment

IaC security involves analyzing infrastructure templates for security misconfigurations, hardcoding of secrets, and policy violations before they are deployed to the cloud.

Which type of cloud storage misconfiguration has been responsible for many high-profile US data breaches?

Answer: Publicly accessible storage buckets (e.g., open S3 buckets) without authentication requirements

Misconfigured public cloud storage buckets have exposed millions of records by allowing unauthenticated internet access to sensitive data files.

What is the security advantage of using ephemeral credentials in cloud environments compared to long-lived static API keys?

Answer: Ephemeral credentials expire quickly, limiting the window of opportunity if they are compromised

Short-lived credentials minimize the blast radius of credential theft because they expire after minutes or hours, rendering stolen tokens useless quickly.

In cloud security, what is the purpose of a Security Group compared to a Network Access Control List (NACL)?

Answer: Security groups are stateful and apply to instances; NACLs are stateless and apply to subnets

Security groups are stateful instance-level firewalls that automatically allow return traffic, while NACLs are stateless subnet-level filters requiring explicit inbound and outbound rules.

Which cloud security principle recommends distributing workloads across multiple availability zones?

Answer: High availability and resilience

Deploying across multiple availability zones ensures that a failure in one physical data center location does not render the entire application unavailable.

What is a primary security concern when using serverless computing (e.g., AWS Lambda, Azure Functions)?

Answer: Over-privileged IAM roles assigned to functions that increase the blast radius of a compromise

Serverless functions often receive excessive IAM permissions beyond what they need, so if a function is compromised, the attacker gains broad access to cloud resources.