NSE NSE Cloud Security & Virtualization 2 — Questions and Answers
Question 1: What does the term 'Infrastructure as Code' (IaC) security mean in cloud environments?
- Writing firewall rules in assembly language
- Scanning and securing infrastructure definition files (e.g., Terraform, CloudFormation) for misconfigurations before deployment (Correct answer)
- Encrypting the cloud provider's physical servers
- Replacing human administrators with automated scripts entirely
Correct answer: Scanning and securing infrastructure definition files (e.g., Terraform, CloudFormation) for misconfigurations before deployment
IaC security involves analyzing infrastructure templates for security misconfigurations, hardcoding of secrets, and policy violations before they are deployed to the cloud.
Question 2: Which type of cloud storage misconfiguration has been responsible for many high-profile US data breaches?
- Enabling server-side encryption
- Publicly accessible storage buckets (e.g., open S3 buckets) without authentication requirements (Correct answer)
- Implementing geo-restrictions on storage
- Enabling versioning on storage buckets
Correct answer: Publicly accessible storage buckets (e.g., open S3 buckets) without authentication requirements
Misconfigured public cloud storage buckets have exposed millions of records by allowing unauthenticated internet access to sensitive data files.
Question 3: What is the security advantage of using ephemeral credentials in cloud environments compared to long-lived static API keys?
- Ephemeral credentials are easier to memorize
- Ephemeral credentials expire quickly, limiting the window of opportunity if they are compromised (Correct answer)
- Ephemeral credentials do not require IAM policies
- Ephemeral credentials bypass MFA requirements
Correct answer: Ephemeral credentials expire quickly, limiting the window of opportunity if they are compromised
Short-lived credentials minimize the blast radius of credential theft because they expire after minutes or hours, rendering stolen tokens useless quickly.
Question 4: In cloud security, what is the purpose of a Security Group compared to a Network Access Control List (NACL)?
- Security groups are stateless and apply to subnets; NACLs are stateful and apply to instances
- Security groups are stateful and apply to instances; NACLs are stateless and apply to subnets (Correct answer)
- Both security groups and NACLs are applied only at the VPC gateway
- Security groups control physical server access; NACLs control virtual machine access
Correct answer: Security groups are stateful and apply to instances; NACLs are stateless and apply to subnets
Security groups are stateful instance-level firewalls that automatically allow return traffic, while NACLs are stateless subnet-level filters requiring explicit inbound and outbound rules.
Question 5: Which cloud security principle recommends distributing workloads across multiple availability zones?
- Defense in depth
- Least privilege
- High availability and resilience (Correct answer)
- Zero trust networking
Correct answer: High availability and resilience
Deploying across multiple availability zones ensures that a failure in one physical data center location does not render the entire application unavailable.
Question 6: What is a primary security concern when using serverless computing (e.g., AWS Lambda, Azure Functions)?
- The inability to monitor serverless function logs
- Over-privileged IAM roles assigned to functions that increase the blast radius of a compromise (Correct answer)
- The lack of network connectivity for serverless functions
- The requirement to manage OS patching for serverless environments
Correct answer: Over-privileged IAM roles assigned to functions that increase the blast radius of a compromise
Serverless functions often receive excessive IAM permissions beyond what they need, so if a function is compromised, the attacker gains broad access to cloud resources.
NSE NSE Cloud Security & Virtualization 2
What does the term 'Infrastructure as Code' (IaC) security mean in cloud environments?