GSEC Virtualization, Cloud, and AI Essentials Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable function-level concurrency limits to prevent runaway executions.

  Why it's wrong here

  Concurrency limits control how many instances of the function run simultaneously, which helps with cost and availability. They do not constrain what permissions the function has. An attacker using the function's role would still have full administrative access, so this control does not address the least privilege finding.

• ✗

  Move the function's credentials into environment variables encrypted with a customer-managed key.

  Why it's wrong here

  Encrypting credentials at rest protects them from casual disclosure, but the role still grants full administrative access once assumed. The over-privileged permissions remain the core problem, so this change does not reduce the effective privilege of the function and fails to apply least privilege.

• ✗

  Configure the function to run inside a virtual private cloud with restrictive security groups.

  Why it's wrong here

  Network controls restrict where the function can send and receive traffic but do not limit which cloud API actions its role can perform. The function could still call administrative APIs over allowed endpoints. Since the finding is about excessive permissions rather than network reachability, this option does not remediate the issue.

• ✓

  Replace the administrative role with a role scoped to the specific object storage bucket and database table the function uses.

  Why this is correct

  Scoping the execution role to only the bucket and table the function needs removes the broad administrative permissions and limits the blast radius if the function is compromised. This directly implements least privilege for the serverless workload while preserving its required read and write operations.