GSEC Virtualization, Cloud, and AI Essentials Practice Questions

Explanation: The policy grants overly broad read access to the entire 'company-data' bucket. By including both the bucket and its objects, the user can list and download every file within the container. This violates the principle of least privilege if the user only requires access to a specific sub-folder. Security teams must ensure policies define the narrowest scope possible to prevent data over-exposure during incidents.

Explanation: The shared responsibility model creates a gap where customers often assume the provider handles security tasks that are actually their responsibility. Misunderstanding these boundaries leads to unprotected data, mismanaged configurations, and lack of visibility. Practitioners must explicitly define ownership for patching, identity management, and data encryption to ensure no security gaps exist between the provider's infrastructure and the customer's deployed workloads.

Explanation: Prompt injection involves crafting inputs designed to override the model's system instructions. Since LLMs treat user input as instructions, robust input validation and the use of sandboxed environments are necessary. This approach prevents attackers from forcing the model to perform unauthorized actions, such as disclosing sensitive data or bypassing internal logic, which is crucial for maintaining the security of AI-driven business processes.

Explanation: Micro-segmentation is critical in virtualized environments because traditional network perimeter defenses cannot see traffic moving between VMs on the same host. By applying host-based or hypervisor-level firewalls, security teams restrict traffic based on identity and function rather than IP address. This mitigates the risk of a compromised workload pivoting to sensitive internal assets within the shared virtual infrastructure, which is a key security requirement for modern cloud architectures.

Explanation: Proper S3 configuration requires a defense-in-depth approach that prevents public access while explicitly restricting actions to necessary services. By blocking public access, enforcing TLS for transit, and using explicit IAM roles, the organization minimizes the attack surface. This is vital because S3 buckets are frequent targets for misconfiguration that leads to data exposure, making granular policy control an essential defensive requirement for protecting cloud-based sensitive information.