GSEC Virtualization, Cloud, and AI Essentials — 10 Questions

Question 1

Refer to the exhibit. A cloud administrator applies this IAM policy to a user. What is the security impact of this specific policy?

Accepted Answer

The user gains excessive access to all objects in the bucket, potentially violating least privilege.. The policy grants overly broad read access to the entire 'company-data' bucket. By including both the bucket and its objects, the user can list and download every file within the container. This violates the principle of least privilege if the user only requires access to a specific sub-folder. Security teams must ensure policies define the narrowest scope possible to prevent data over-exposure during incidents.

Answer

The policy restricts the user to read-only access for files inside the root directory only.

Answer

The policy permits the user to delete data from the bucket because s3:ListBucket is present.

Answer

The policy is invalid because the resource ARN formatting is missing the account ID.

Question 2

Which THREE of the following are primary security risks associated with the shared responsibility model in public cloud computing?

Accepted Answer

Failure to configure appropriate IAM roles for cloud services.. The shared responsibility model creates a gap where customers often assume the provider handles security tasks that are actually their responsibility. Misunderstanding these boundaries leads to unprotected data, mismanaged configurations, and lack of visibility. Practitioners must explicitly define ownership for patching, identity management, and data encryption to ensure no security gaps exist between the provider's infrastructure and the customer's deployed workloads.

Answer

Cloud provider failure to patch physical server firmware.

Answer

Lack of visibility into the cloud provider's physical security protocols.

Question 3

An organization is deploying an AI model that processes financial data. What is the most effective approach to ensure that 'Prompt Injection' attacks do not compromise the system's integrity?

Accepted Answer

Use a secondary model to validate and sanitize user inputs.. Prompt injection involves crafting inputs designed to override the model's system instructions. Since LLMs treat user input as instructions, robust input validation and the use of sandboxed environments are necessary. This approach prevents attackers from forcing the model to perform unauthorized actions, such as disclosing sensitive data or bypassing internal logic, which is crucial for maintaining the security of AI-driven business processes.

Answer

Encrypt all input strings using AES-256 before model processing.

Answer

Increase the training dataset size to include more financial scenarios.

Answer

Limit the number of API queries allowed per user per hour.

Question 4

An organization is migrating to a hybrid cloud environment. Which security control is most effective for preventing unauthorized lateral movement between virtual machines residing on the same physical hypervisor?

Accepted Answer

Utilizing micro-segmentation policies via distributed firewalls.. Micro-segmentation is critical in virtualized environments because traditional network perimeter defenses cannot see traffic moving between VMs on the same host. By applying host-based or hypervisor-level firewalls, security teams restrict traffic based on identity and function rather than IP address. This mitigates the risk of a compromised workload pivoting to sensitive internal assets within the shared virtual infrastructure, which is a key security requirement for modern cloud architectures.

Answer

Deploying a Network Intrusion Detection System (NIDS) at the virtual switch level.

Answer

Implementing a traditional hardware-based firewall at the edge of the datacenter.

Answer

Enforcing full disk encryption on all virtual hard drives.

Question 5

A security engineer is configuring a new AWS S3 bucket to store sensitive PII. Which combination of settings best adheres to the principle of least privilege for the bucket policy?

Accepted Answer

Restrict access to specific IAM roles and require Secure Transport.. Proper S3 configuration requires a defense-in-depth approach that prevents public access while explicitly restricting actions to necessary services. By blocking public access, enforcing TLS for transit, and using explicit IAM roles, the organization minimizes the attack surface. This is vital because S3 buckets are frequent targets for misconfiguration that leads to data exposure, making granular policy control an essential defensive requirement for protecting cloud-based sensitive information.

Answer

Enable public access and rely on bucket ACLs for granular object permission.

Answer

Assign full administrative rights to the bucket root user for ease of management.

Answer

Use a wildcard principal in the bucket policy to allow internal cross-account access.

Question 6

Which TWO of the following practices are recommended to mitigate the risk of 'Model Inversion' attacks in an AI/ML deployment?

Accepted Answer

Apply differential privacy noise to the training dataset.. Model inversion attacks involve querying an ML model to reconstruct sensitive training data. To mitigate this, developers must limit the information revealed by the API and implement differential privacy. These techniques ensure that individual data records cannot be reverse-engineered from model outputs. This is essential for maintaining compliance with privacy regulations like GDPR and CCPA, which mandate the protection of training data from unauthorized reconstruction.

Answer

Increase the confidence interval thresholds in the model API output.

Answer

Implement multi-factor authentication for all API management endpoints.

Answer

Regularly rotate the API keys used to access the inference model.

Question 7

Which virtualization security concern occurs when an attacker breaks out of the guest operating system to interact directly with the hypervisor?

Accepted Answer

Virtual Machine escape.. A VM escape is a critical vulnerability where an attacker gains access to the host machine from a guest VM. This allows the attacker to compromise other VMs on the same host or the physical hardware itself. Understanding this threat is essential for GSEC professionals, as it represents the highest level of breach in a virtualized infrastructure, requiring rigorous patching and hypervisor hardening.

Answer

Resource exhaustion.

Answer

Snapshot tampering.

Answer

Hypervisor misconfiguration.

Question 8

Which cloud security concept describes the automation of infrastructure deployment using code templates to ensure a consistent, secure, and repeatable environment?

Accepted Answer

Infrastructure as Code.. Infrastructure as Code (IaC) allows for version-controlled, automated, and audited deployment of cloud resources. By treating infrastructure as software, security teams can scan templates for misconfigurations before deployment. This is vital in cloud environments because manual configuration is prone to human error, which is the leading cause of security breaches in modern cloud and virtualization deployments.

Answer

Container Orchestration.

Answer

Serverless Computing.

Answer

Hyper-converged Infrastructure.

Question 9

A financial services company runs sensitive workloads on a Type 1 hypervisor. The security team wants to detect if a guest VM attempts to escape and directly access the hypervisor's memory. Which virtualization-specific security control should they implement?

Accepted Answer

Hypervisor introspection. Hypervisor introspection is specifically designed to monitor guest VM memory and state from the hypervisor level, enabling detection of escape attempts. Other controls like virtual firewalls or guest-based HIDS operate at different layers and cannot observe the hypervisor-guest boundary. For detecting direct hypervisor memory access by a guest, introspection is the appropriate virtualization-specific control.

Answer

Host-based intrusion detection system (HIDS) on each guest

Answer

Virtual firewall

Answer

Security information and event management (SIEM) correlation

Question 10

A healthcare organization uses a public cloud IaaS provider to host electronic health records (EHRs). The security team must ensure that data at rest is encrypted and that the cloud provider cannot access the plaintext. Which approach best meets this requirement?

Accepted Answer

Implement client-side encryption with customer-managed keys stored on-premises.. Client-side encryption with customer-managed keys stored on-premises ensures that the cloud provider never has access to the encryption keys or plaintext data. Provider-managed keys leave the provider with decryption capability, failing the requirement. Other options like CASB or server-side encryption do not fully prevent provider access to plaintext.

Answer

Enable server-side encryption with provider-managed keys and enforce TLS for data in transit.

Answer

Use provider-managed encryption keys with automatic rotation.

Answer

Use a cloud access security broker (CASB) to encrypt data before it reaches the cloud.