CCSK Infrastructure Security and Virtualization 1 — Questions and Answers
Question 1: What is a 'hypervisor escape' attack and why is it particularly dangerous in cloud environments?
- An attack that overloads the cloud management console
- An attack where malicious code breaks out of a VM to access the hypervisor and other VMs on the same host (Correct answer)
- An attack that exploits weak encryption on virtual disks
- An attack targeting container orchestration platforms
Correct answer: An attack where malicious code breaks out of a VM to access the hypervisor and other VMs on the same host
Hypervisor escape allows malware from one tenant's VM to break through to the hypervisor layer, potentially accessing other tenants' VMs on the same physical host.
Question 2: According to CCSK, what is 'network segmentation' in virtual cloud environments used to achieve?
- Increasing bandwidth between cloud regions
- Isolating workloads to limit blast radius if one segment is compromised (Correct answer)
- Compressing network traffic to reduce costs
- Balancing load across multiple availability zones
Correct answer: Isolating workloads to limit blast radius if one segment is compromised
Network segmentation isolates workloads so that a breach in one segment cannot easily spread laterally to other parts of the environment.
Question 3: What security benefit do 'dedicated hosts' or 'dedicated instances' provide in public cloud?
- Lower cost through shared resource pools
- Physical isolation from other customers' workloads, eliminating multi-tenancy risks at the hardware level (Correct answer)
- Automatic encryption of all data at rest
- Faster provisioning compared to shared infrastructure
Correct answer: Physical isolation from other customers' workloads, eliminating multi-tenancy risks at the hardware level
Dedicated hosts provide a physical server used exclusively by one customer, eliminating the risk of cross-tenant data leakage through shared hardware.
Question 4: What is 'VM sprawl' and what security risk does it create in cloud environments?
- The spread of unpatched virtual machines that are difficult to track and manage, creating unmanaged attack surfaces (Correct answer)
- The replication of VMs across too many availability zones
- The duplication of VM configurations causing performance issues
- The spread of VM images to public repositories without encryption
Correct answer: The spread of unpatched virtual machines that are difficult to track and manage, creating unmanaged attack surfaces
VM sprawl results in orphaned, unpatched VMs that are forgotten but still running, creating entry points for attackers that are outside normal patching and monitoring.
Question 5: According to CCSK, what is a 'golden image' and how does it contribute to infrastructure security?
- A backup copy of a cloud provider's management console
- A hardened, pre-approved VM or container image that serves as the baseline for all deployments (Correct answer)
- A financial record of cloud spending over time
- A certified encryption standard for cloud storage
Correct answer: A hardened, pre-approved VM or container image that serves as the baseline for all deployments
A golden image is a security-hardened, pre-approved template ensuring all deployed instances start from a known secure state rather than default configurations.
Question 6: What is the primary security concern with 'live migration' of virtual machines in cloud environments?
- Live migration increases latency for all cloud services
- VM memory contents, potentially including sensitive data and keys, are transmitted between hosts during migration (Correct answer)
- Live migration requires rebooting all VMs on the source host
- Live migration permanently deletes the source VM image
Correct answer: VM memory contents, potentially including sensitive data and keys, are transmitted between hosts during migration
During live migration, VM memory (which may contain encryption keys, passwords, or sensitive data) is transmitted between physical hosts, creating an interception risk.
CCSK Infrastructure Security and Virtualization 1
What is a 'hypervisor escape' attack and why is it particularly dangerous in cloud environments?