Which of the following is a common security issue associated with serverless computing environments?
Correct Answer: B
Serverless environments are vulnerable to misconfigurations, which can expose sensitive data and resources, making security configurations critical. Reference: [Security Guidance v5, Domain 8 - Cloud Workload Security][16†source].
Question 142
In which deployment model should the governance strategy consider the minimum common set of controls comprised of the Cloud Service Provider contract and the organization's internal governance agreements?
Correct Answer: A
Question 143
Which of following is an exploit in which the attacker runs code on a VM that allows an operating system running within it to break out and interact directly with the hypervisor?
Correct Answer: B
Virtual machine escape is an exploit in which the attacker runs code on a VM that allows an operating system running within it to break out and interact directly with the hypervisor. Such an exploit could give the attacker access to the host operating system and all other virtual machines(VMs) running on that host.
Question 144
Which of the following is true about access policies in cybersecurity?
Correct Answer: D
Access policies in cybersecurity are critical for managing and controlling how users and devices access resources within a network or cloud environment. These policies are primarily concerned with defining permissions and rules that govern access to resources. They help organizations implement role-based access control (RBAC) or attribute-based access control (ABAC), which specify who can access what resources and under what conditions. In the context of cloud computing, access policies are typically enforced using Identity and Access Management (IAM) tools and services, which allow administrators to define and manage the permissions associated with user identities. Access policies include various rules that specify allowed or denied actions based on roles, user attributes, device types, or network conditions. For example, in the AWS environment, access policies are written in JSON and define permissions for services like EC2, S3, or RDS. Similarly, Azure uses Role-Based Access Control (RBAC) to manage resource access policies. Access policies are not concerned with real-time monitoring (option A), user authentication methods (option B), or encryption protocols (option C). Instead, they explicitly focus on defining access permissions and controlling how resources are utilized. Reference: CSA Security Guidance v4.0, Domain 12: Identity, Entitlement, and Access Management Cloud Computing Security Risk Assessment (ENISA) - Identity and Access Management section Cloud Controls Matrix (CCM) v3.0.1 - IAM Domain
Question 145
ENISA: A reason for risk concerns of a cloud provider being acquired is:
