CCNA Cloud Platform and Infrastructure Security Questions

A cloud transit gateway acts as a regional hub, peering each VPC through a single attachment rather than building a full mesh of pairwise connections. This satisfies the centralised policy enforcement and simplified management constraints, since security rules and routing are configured once at the hub across all accounts.

VM escape exploits abuse hypervisor vulnerabilities, so regularly patching and updating the hypervisor removes the flaws an attacker needs to break out of a guest. This directly mitigates the escape vector in a multi-tenant environment where one flaw could expose co-resident tenants.

AWS WAF attached to an Application Load Balancer inspects HTTP/HTTPS requests at layer 7, blocking SQL injection, cross-site scripting and similar OWASP threats. This satisfies the requirement to protect the application layer from common web attacks.

Security groups support source referencing, so the app tier's inbound rule names the web server security group and the database tier's names the app server security group. This enforces the tiered traffic flow on port 3306 without hard-coded CIDRs, satisfying the stem's constraints.

VPC peering establishes a direct routing relationship between two VPCs using their private IPv4 or IPv6 addresses, so instances communicate over the cloud provider's internal backbone. Traffic never traverses the public internet, satisfying the private connectivity requirement without gateways or VPNs.

Security groups are stateful, attach to elastic network interfaces, and support referencing another security group as a source. This lets the database tier accept traffic only from the application tier's group, and the application tier only from the web tier's group, without hardcoding subnet CIDR ranges. Replacement instances that join the same group inherit the rules automatically, which matches the architect's requirements exactly.

Distroless images contain only the application and its runtime dependencies, omitting package managers, shells and OS utilities. Removing these unnecessary components shrinks the attack surface and reduces the CVE count, directly satisfying the stem's constraint.

This approach follows the principle of least privilege by granting only the necessary permission to the specific bucket. The IAM role is assumed by the Lambda function at runtime, and AWS automatically rotates the temporary credentials. This eliminates hardcoded credentials and ensures secure access. It is the recommended best practice for Lambda functions.

Per-tenant KMS keys with scoped key policies enforce cryptographic isolation at the key-management layer. Even if an application instance is compromised, its IAM role only has decrypt permission on its own tenant's key, so it cannot decrypt other tenants' ciphertext. This directly satisfies the requirement.

Rate limiting caps how many requests a client may issue per time window, throttling abusive bursts before they exhaust backend capacity. This directly satisfies the stem's constraint of preventing abuse or denial-of-service attacks, unlike authentication or encryption features that address identity and confidentiality instead.

Running containers as a non-root user removes UID 0 inside the container, so a breakout or exploited process lacks root privileges on the host mount namespace. This directly reduces privilege-escalation risk, satisfying the hardening requirement alongside capability dropping and mandatory access controls.

VM escape exploits a hypervisor or virtualisation flaw so code inside a guest breaks isolation and executes at the hypervisor layer. From there an attacker reads or controls other tenants' VMs on the same host, defeating multi-tenancy separation.

The leak occurred because containers on the same node share kernel and, in some configurations, process namespaces that allow visibility into sibling workloads. Stronger isolation boundaries such as gVisor, Kata Containers, or user namespaces with distinct runtime classes prevent one tenant's container from observing another's process environment. This directly closes the cross-tenant visibility path observed by the penetration test.

Type 1 hypervisors such as VMware ESXi run directly on hardware and are the standard production platform in cloud data centres, hosting many tenant VMs per physical host. Type 2 hypervisors run atop a host OS and are unsuitable for that scale and isolation.

Rate limiting caps request volume per client or API key, throttling brute-force attempts, credential stuffing and volumetric abuse before they reach backend services. It directly addresses the API abuse constraint by bounding how many calls an attacker can issue.

A Type 1 hypervisor runs directly on bare-metal hardware without an underlying host OS, eliminating the host kernel as a shared attack surface and providing stronger isolation between tenant virtual machines than hosted Type 2 hypervisors.

Network Policies are Kubernetes objects that select pods by label and define permitted ingress and egress rules, enforced by the CNI plugin. They satisfy the stem's label-based restriction on inter-pod traffic, unlike security groups or firewall rules that operate outside pod identity.

Schema-per-tenant with role-scoped grants limits each tenant's session to its own schema, providing a strong boundary. Combined with row-level policies or as an alternative, it prevents cross-tenant access at the privilege layer and reduces the blast radius of a compromised application credential.

AWS WAF attaches to API Gateway stages and inspects HTTP requests against managed or custom rules, blocking SQL injection and cross-site scripting payloads before they reach the backend. This satisfies the requirement to protect the exposed API against common web exploits.

Running the container as a non-root user removes UID 0 inside the container, so a breakout attempt lands with unprivileged rights on the host and cannot modify protected files or kernel interfaces. This directly mitigates the root-with-full-capabilities risk the auditor identified.

Cosign signs container images with cryptographic keys, producing a signature stored alongside the image in the registry. This gives verifiable provenance, satisfying the supply-chain integrity requirement by letting downstream systems confirm the image was not tampered with after signing.

SSE-KMS with a customer managed key gives the organization control over key policy, rotation, and usage auditing via CloudTrail, which directly satisfies the auditor's requirement. Applications continue to use the standard S3 API; only IAM permissions for the KMS key are added. This minimizes code changes while providing independent key control and auditability.

Client-side encryption ensures data is encrypted before it reaches the cloud provider, so the provider never sees plaintext. Storing the key in an external KMS that the company controls allows immediate revocation and provides audit evidence that the provider cannot access the key. This directly satisfies all stated requirements: customer control, immediate revocation, and provable provider inaccessibility.

Cosign signing creates a verifiable cryptographic attestation binding each image digest to a trusted publisher identity. This satisfies the supply-chain integrity constraint by enabling admission controllers to reject unsigned or tampered images before deployment, ensuring only artefacts built through approved pipelines reach the container runtime.

Azure Defender for Servers (part of Microsoft Defender for Cloud) provides advanced threat protection for VMs, including file integrity monitoring, detection of suspicious kernel driver loads, and behavioral analytics. It can alert on rootkits and other kernel-level anomalies. This service is designed to meet the requirement for detecting and alerting on kernel-level malware and file integrity changes.

Security groups can reference another security group as a source, so the database rule permits traffic only from instances that carry the application tier's group membership. As the application tier scales in or out, membership updates automatically, requiring no rule edits, which satisfies the requirement with minimal ongoing operational effort.

Placing web servers in a public subnet, app servers in a private subnet and databases in an isolated subnet, each governed by security groups, enforces the required traffic flow: internet to web only, web to app, and app to database.

Network ACLs are stateless and operate at the subnet level. They require explicit rules for both inbound and outbound traffic, and return traffic must be allowed by an outbound rule. This matches the requirement to control traffic at the subnet level with explicit outbound allowances. They are the correct component for subnet-level traffic filtering in a VPC.

Immutable tags map a fixed tag to one digest, so every deployment pulls byte-identical content. This eliminates drift between environments and gives the consistent, reproducible deployments the stem asks for, unlike mutable tags that can be overwritten silently.

Security groups operate at the instance level, are stateful, and permit allow rules only. NACLs operate at the subnet level, are stateless, and support both allow and deny rules, so return traffic must be explicitly permitted in each direction.

IOMMU (Input-Output Memory Management Unit) maps device DMA requests to guest physical addresses, letting a VM access hardware directly while confining each device to its assigned memory region. This delivers near-native I/O performance and enforces isolation between guests, satisfying the stem's requirement for direct device access.

A Type 1 hypervisor runs directly on bare metal, so each tenant VM's isolation boundary is enforced by the hypervisor kernel itself rather than a general-purpose host OS. That removes the host operating system's larger attack surface, satisfying the requirement for the most robust isolation between tenants.

The --privileged flag grants the container all Linux capabilities and unrestricted device access, disabling the namespace and cgroup barriers that normally confine it. An attacker inside can then mount the host filesystem or manipulate kernel interfaces to escape onto the host.

VPC integration allows Lambda to access resources in a VPC.

Placing the Lambda function inside the VPC via VPC configuration gives it an elastic network interface in a private subnet, allowing it to reach the RDS instance over private IP addresses. No public IP or internet gateway is required for the database connection.

WAF integration inspects HTTP requests and blocks injection payloads such as SQL or command strings, while rate limiting caps requests per client to prevent abuse and denial-of-service. Together they satisfy both the injection and excessive-usage constraints.

A virtual TPM records hashes of firmware, bootloader, and hypervisor components into platform configuration registers during the boot chain, and remote attestation lets the tenant verify those measurements against a known-good baseline. This gives cryptographic evidence that the platform was not tampered with, directly satisfying the auditor's requirement for proof of an untampered boot.

Cosign signs and verifies container images using keys or keyless OIDC identities, producing signatures that establish image integrity and provenance. It directly satisfies the supply chain requirement by letting deployments reject unsigned or tampered images before they run.

A Role defines permissions within a single namespace, and a RoleBinding grants those permissions to the service account only in that namespace. This satisfies the stem's constraint that pod creation is limited to the 'dev' namespace, unlike ClusterRole and ClusterRoleBinding.

A read-only root filesystem prevents attackers from writing malicious binaries or modifying system files inside the container, and dropping unnecessary Linux capabilities removes the ability to perform privileged operations such as mounting filesystems or loading kernel modules. Together they significantly reduce the container's ability to escalate privileges or break out to the node.

TLS enforcement at the gateway encrypts traffic between clients and API Management, preventing credential and token interception in transit. This satisfies the requirement to secure exposed API endpoints at the gateway layer, independent of backend Azure Functions configuration.

Using a distinct IAM role per function with narrowly scoped permissions ensures that each function can only access its required resources. If one function is compromised, the attacker cannot use its role to access other resources. This is the most effective way to enforce least privilege and limit lateral movement.

Least privilege limits what a compromised management credential can do, and mandatory multi-factor authentication makes stolen passwords or tokens insufficient on their own. Together they constrain both the likelihood of credential compromise succeeding and the scope of damage if it does. This combination is a core control for protecting administrative interfaces in cloud environments.

Dropping all Linux capabilities removes the privileges an attacker needs to break out of the container's namespace isolation, while the read-only root filesystem and Seccomp profile block the syscalls and filesystem writes that privilege-escalation exploits rely on. Together these harden the container boundary against escape.

Pod Security Admission enforces Pod Security Standards at the namespace level, with the restricted profile rejecting pods that run as root or mount host paths. This declaratively satisfies both constraints the DevOps engineer needs to enforce.

These MAC systems enforce security policies on containers.

Security groups are stateful, instance-level virtual firewalls that support referencing another security group as the source in an inbound rule. The database tier's group can allow traffic only from the application tier's group, and the application tier's group can allow traffic only from the web tier's group. This expresses tier isolation in terms of logical group membership rather than IP addresses, so it remains correct as instances scale.

This design layers stateless network ACLs at the subnet boundary with stateful security groups at the instance level, which is the intended defense-in-depth model in a VPC. The database tier references the web tier's security group rather than a CIDR, so only authorized instances can connect. Denying internet CIDRs at the network ACL adds a second, independent barrier.

VPC integration places the function's elastic network interfaces inside private subnets, so traffic to the database stays on the AWS private network and never routes through an internet gateway or NAT. This directly satisfies the requirement to avoid public internet traversal.

A VM escape exploits a hypervisor or virtualisation flaw to break out of the guest boundary, letting the attacker execute code on the host. From there they can read or manipulate other tenants' VM memory and data, so unauthorised access to co-resident tenant VMs is the defining risk.

Cosign signs container images and stores signatures in the registry, letting an admission controller verify provenance before pods are admitted. This enforces the trusted-registry constraint at admission time, rejecting any unsigned or tampered image before it reaches the cluster.

Admission controllers intercept API server requests before pods persist, so OPA Gatekeeper can query a signature-verification policy and reject unsigned or untrusted images. This enforces the trusted-authority constraint at admission time rather than relying on later scanning or runtime detection.

The --privileged flag disables the default seccomp, AppArmor and capability restrictions, granting the container nearly all Linux capabilities plus access to host devices. That lets an attacker mount the host filesystem or load kernel modules, escaping to the host kernel.

A Private Endpoint (Service Endpoint) maps the database service into the VPC's private address space, so traffic never traverses the public internet. This satisfies the constraint by keeping connectivity on the cloud provider's private backbone rather than via NAT or internet gateway.

In the shared responsibility model, the cloud provider is always responsible for the security of the cloud, which includes the hypervisor, physical hosts, and the network fabric. The provider patches and secures the hypervisor and enforces tenant isolation. The customer cannot perform these tasks in IaaS, so the provider must own them. This is the correct division of responsibility.

Service accounts bound to minimal RBAC permissions limit what API actions each pod identity can perform, so a compromised pod cannot escalate cluster-wide. This satisfies least privilege for pod-to-pod communication by constraining the credentials pods present to the API server.

Per-tenant customer-managed keys allow the provider to cryptographically shred data by destroying the tenant-specific key, so remanence risk is eliminated even if physical blocks are later reallocated to another tenant. This satisfies CCSP expectations for data isolation and secure disposal in multi-tenant storage.

Cosign signs container images with a private key, producing a verifiable signature stored in the registry alongside the image. This establishes provenance and integrity, letting downstream admission controls confirm the image was built by a trusted publisher before deployment.

A private subnet removes the route to an internet gateway, and referencing the load balancer's security group as the source restricts traffic to that balancer. This layered approach ensures no direct internet path and no unauthorized source can reach the application servers.

Many cloud providers let administrators attach conditions to IAM policies that evaluate the source network of an API call. Requiring administrative actions to originate from a known corporate range or a bastion network means a stolen credential used from an attacker's location is rejected outright, adding a strong contextual control independent of the credential itself.

Security groups track connection state, so return traffic is automatically permitted regardless of inbound rules. Network ACLs evaluate each packet independently against their rules, requiring explicit inbound and outbound allowances for both directions of a flow.

A managed identity lets Azure Functions authenticate to Key Vault without stored credentials, and the connection string is retrieved at runtime rather than embedded in code or configuration. This satisfies the stem's most-secure requirement by eliminating secrets from the application entirely.

A service control policy attached at the organization root sets the maximum available permissions for every account in the organization, including the management account when applied at the root. Denying the trail-modification actions blocks the operation regardless of identity-based policy, giving a single preventive guardrail with no per-account maintenance.

VPC peering links exactly two VPCs, so each peering connection is a discrete one-to-one relationship rather than a transitive hub. This satisfies the multi-VPC design constraint: traffic cannot route through a peered VPC to reach a third, requiring explicit mesh or transit gateway topologies.

A distroless image contains only the application and its runtime dependencies, omitting package managers, shells and other OS utilities. This directly minimises the attack surface and vulnerability count, satisfying the stem's requirement to reduce exploitable components in the container image.

Pod Security Admission is the built-in successor to PodSecurityPolicy and enforces the restricted profile, which requires non-root execution, disallows host filesystem mounts, and blocks privilege escalation. A validating admission webhook can enforce custom policies with greater flexibility. Both evaluate pod specifications at admission time and reject non-compliant pods before scheduling, without requiring application code changes.

Client-side encryption performed before the data leaves the customer's environment ensures the provider only ever receives ciphertext. Because the customer never shares the keys, provider personnel cannot decrypt the objects even with full physical access to storage media. This is the classic approach for meeting requirements that the cloud provider itself must be unable to read regulated data, and it directly satisfies the stated constraint.

Extended Page Tables provide hardware-assisted second-level address translation, giving each guest VM its own nested page tables managed by the hypervisor. This isolates guest physical memory so one tenant VM cannot map or read another's memory, directly satisfying the auditor's cross-tenant isolation requirement.

Transit Gateway acts as a regional hub attaching many VPCs and on-premises networks, with transitive routing between attachments. That satisfies the central-hub and transitive-routing constraints, unlike VPC peering, which is non-transitive and requires a mesh of individual connections.

Cosign applies a cryptographic signature tied to the publisher's private key, and verification at deployment rejects any image whose digest or signature fails validation. This satisfies the tamper-evidence and trusted-origin constraint, since unsigned or altered images cannot pass admission.

A hop limit of 1 prevents metadata responses from being forwarded beyond the instance itself, defeating the common attack pattern where a proxy or container layer relays the request. Combined with token enforcement it closes both the request-forging and the forwarding path, and it does not interfere with direct metadata calls made by the application on the instance.

A Type 1 hypervisor runs directly on the host hardware, so it exposes no underlying general-purpose OS for a guest escape to target. That smaller attack surface, plus direct hardware control, satisfies the multi-tenant isolation requirement where a compromised tenant must not reach others or the platform.

Replicating objects to a second region protects against a regional outage, and using customer-managed keys that are also replicated to the destination region ensures the company retains cryptographic control and can decrypt in the secondary region without provider key custody. This combination satisfies both durability and key ownership requirements, and it is the standard pattern for regulated backup architectures.

SSE-KMS with a customer managed key gives the organization control over the key, supports automatic rotation, and allows a key policy that is separate from S3 bucket policies. AWS CloudTrail logs all KMS key usage, providing auditability, and access to keys can be granted independently of access to the S3 data.

Rate limiting caps the number of requests a client may send within a defined time window, returning throttling responses once the threshold is exceeded. This directly satisfies the requirement to prevent a single client from abusing the API during high traffic.