NSE NSE Cloud Security & Virtualization 1 — Questions and Answers
Question 1: In the cloud shared responsibility model, which security tasks are ALWAYS the customer's responsibility regardless of the cloud service model (IaaS, PaaS, SaaS)?
- Physical data center security
- Hypervisor patching
- Data classification and identity/access management (Correct answer)
- Network hardware maintenance
Correct answer: Data classification and identity/access management
Regardless of cloud model, customers always retain responsibility for their data classification, protection, and identity/access management of their users.
Question 2: What is VM escape, and why is it a critical security concern in virtualized environments?
- A VM migrating between hosts without authorization
- An attacker in a guest VM exploiting hypervisor vulnerabilities to gain control of the host or other VMs (Correct answer)
- A VM losing network connectivity during live migration
- A backup process copying VM data to unencrypted storage
Correct answer: An attacker in a guest VM exploiting hypervisor vulnerabilities to gain control of the host or other VMs
VM escape exploits hypervisor flaws to break the isolation boundary, allowing a malicious guest VM to access the host OS or other tenant VMs.
Question 3: Which cloud deployment model provides the HIGHEST level of control over security configurations for an organization?
- Public cloud
- Community cloud
- SaaS-delivered cloud
- Private cloud (Correct answer)
Correct answer: Private cloud
A private cloud gives the organization full control over infrastructure, hypervisors, and security configurations since the environment is dedicated solely to that organization.
Question 4: What is the primary security purpose of a Cloud Access Security Broker (CASB)?
- To replace on-premises firewalls with cloud-hosted ones
- To provide visibility and policy enforcement between users and cloud services (Correct answer)
- To encrypt cloud storage buckets automatically
- To manage physical access to cloud data centers
Correct answer: To provide visibility and policy enforcement between users and cloud services
A CASB sits between cloud service consumers and cloud providers to enforce security policies, provide visibility, and detect shadow IT usage.
Question 5: In a containerized environment, which security practice reduces the attack surface of container images?
- Using the latest full OS base image for all containers
- Building minimal images with only required dependencies and running containers as non-root (Correct answer)
- Sharing the host kernel with unrestricted capabilities
- Disabling container image scanning to speed up deployment
Correct answer: Building minimal images with only required dependencies and running containers as non-root
Minimal base images reduce the number of packages that could contain vulnerabilities, and non-root execution limits the damage if a container is compromised.
Question 6: Which security risk is unique to multi-tenant cloud environments compared to traditional on-premises infrastructure?
- The need to patch operating systems
- Data leakage between tenants due to improper isolation at the hypervisor or storage layer (Correct answer)
- The requirement for physical access controls
- The use of role-based access control
Correct answer: Data leakage between tenants due to improper isolation at the hypervisor or storage layer
Multi-tenancy introduces the risk that misconfigurations or vulnerabilities could allow one tenant's data to be exposed to another, a scenario impossible in single-tenant environments.
NSE NSE Cloud Security & Virtualization 1
In the cloud shared responsibility model, which security tasks are ALWAYS the customer's responsibility regardless of the cloud service model (IaaS, PaaS, SaaS)?