NSE Cloud Security & Virtualization Flashcards

In the cloud shared responsibility model, which security tasks are ALWAYS the customer's responsibility regardless of the cloud service model (IaaS, PaaS, SaaS)?

Answer: Data classification and identity/access management

Regardless of cloud model, customers always retain responsibility for their data classification, protection, and identity/access management of their users.

What is VM escape, and why is it a critical security concern in virtualized environments?

Answer: An attacker in a guest VM exploiting hypervisor vulnerabilities to gain control of the host or other VMs

VM escape exploits hypervisor flaws to break the isolation boundary, allowing a malicious guest VM to access the host OS or other tenant VMs.

Which cloud deployment model provides the HIGHEST level of control over security configurations for an organization?

Answer: Private cloud

A private cloud gives the organization full control over infrastructure, hypervisors, and security configurations since the environment is dedicated solely to that organization.

What is the primary security purpose of a Cloud Access Security Broker (CASB)?

Answer: To provide visibility and policy enforcement between users and cloud services

A CASB sits between cloud service consumers and cloud providers to enforce security policies, provide visibility, and detect shadow IT usage.

In a containerized environment, which security practice reduces the attack surface of container images?

Answer: Building minimal images with only required dependencies and running containers as non-root

Minimal base images reduce the number of packages that could contain vulnerabilities, and non-root execution limits the damage if a container is compromised.

Which security risk is unique to multi-tenant cloud environments compared to traditional on-premises infrastructure?

Answer: Data leakage between tenants due to improper isolation at the hypervisor or storage layer

Multi-tenancy introduces the risk that misconfigurations or vulnerabilities could allow one tenant's data to be exposed to another, a scenario impossible in single-tenant environments.