CCNA Cloud Platform and Infrastructure Security Questions

VM escape attacks exploit vulnerabilities in the hypervisor to break out of a guest VM and access the host or other guests. Regularly patching the hypervisor closes known vulnerabilities (e.g., Xen, KVM, VMware ESXi CVEs) that attackers use to escape, making it the most direct and effective mitigation. Since the hypervisor is the isolation boundary, keeping it current is foundational to VM security.

VNet integration allows Azure Functions to access resources in a virtual network without exposing them to the internet, using a private IP.

Under the shared responsibility model for IaaS, the provider owns security of the cloud, including facilities, hardware, and the hypervisor, while the customer owns security in the cloud. That includes the guest operating system, runtime, applications, and data. Because the question concerns a cardholder data environment, the customer must demonstrate patch management for the guest OS and applications as part of PCI DSS compliance obligations.

Memory isolation via hardware-enforced page tables (using CPU features like Intel VT-x EPT or AMD-V NPT) ensures that each VM's memory is mapped in separate address spaces managed by the hypervisor, so a guest cannot address or read another guest's physical memory. This is the fundamental hypervisor-level mechanism that enforces memory isolation between tenants. It directly addresses the requirement that one tenant's VM cannot access another's memory.

A security group rule that names the application tier's security group as its source gives an identity-based, stateful permission that tracks instances through scaling events and excludes every other resource in the VPC. CIDR-based subnet filters and VPC-wide rules are broader than needed, and PrivateLink does not address intra-VPC tier isolation.

The correct remediation is to replace the overly permissive execution role with a custom IAM role scoped to only the specific S3 actions and the specific bucket the Lambda function actually needs. This directly enforces least privilege by eliminating the wildcard delete permissions across all buckets. AWS IAM evaluates the policy attached to the Lambda execution role on every API call, so narrowing the Resource ARN and Action list constrains the blast radius if the function is compromised.

An admission controller like OPA Gatekeeper or Kyverno can enforce policies that verify image signatures before allowing pod creation.

Using a minimal base image such as distroless is the most effective way to reduce a container image's attack surface because it strips the package manager, shell, and unnecessary OS utilities, leaving only the application and its runtime dependencies. Fewer installed packages means fewer libraries that can contain exploitable CVEs, and the absence of a shell makes post-exploitation pivoting much harder. Distroless images, maintained by Google, include only the runtime (e.g., a JRE or Python interpreter) and the app itself.

The requirement is for a FIPS 140-2 Level 3 validated HSM with minimal operational overhead and keys that never leave the HSM. A managed HSM service provides dedicated, validated hardware while the provider handles maintenance and availability, satisfying both security and operational needs. Alternatives either lack hardware validation, export keys outside the boundary, or add unnecessary management burden.

Security groups are stateful and can reference other security groups as sources, which is the most precise way to allow only instances with a specific application security group to reach the database. Network ACLs are stateless and subnet-level; they cannot reference security group IDs and should generally be left at default allow unless additional subnet-level controls are needed. Allowing the application security group ID on the database security group meets the requirement exactly.

Enforcing MFA for human users is best achieved through federation with an identity provider that applies MFA, such as SAML 2.0, which issues temporary console sessions. For programmatic access, assuming IAM roles via AWS STS provides temporary credentials that rotate automatically, eliminating long-term access keys. Together these practices enforce MFA and short-lived credentials, aligning with cloud security best practices.

Kyverno is a Kubernetes-native policy engine that functions as a validating admission controller. It can enforce policies that check container image signatures (e.g., using Cosign) at deploy time by validating the image's signature against a public key before allowing the pod to be created. This directly satisfies the requirement to only allow signed images.

VPC interface endpoints (AWS PrivateLink) and S3 gateway endpoints let resources in private subnets reach AWS services entirely over the AWS private network, with no internet gateway, NAT, or public IP required. This satisfies the no-internet constraint, supports both patch retrieval and secret access, and requires minimal ongoing operational effort compared to firewall or NAT-based designs.

Session Manager provides keyless, auditable interactive access that inherits the federated IAM identity, so every session is attributable to a named administrator and no standing SSH keys exist. The other designs either retain long-lived key material or produce only network-level telemetry that cannot identify the human operator, which fails the auditors' attribution and key-elimination requirements.

A SOC 2 Type II report gives independent, period-based assurance over control design and operating effectiveness, including physical security, which directly satisfies auditor evidence requirements. Whitepapers, ISO certificates, and penetration test reports either lack independent testing, lack control-effectiveness detail, or address different scopes.

Blocking egress to 169.254.169.254 with a NetworkPolicy directly prevents pods from reaching the instance metadata service, which is the specific vector for stealing node credentials. PodSecurity, credential rotation, and service mesh mTLS address different risks and do not stop a pod from querying the metadata endpoint.

Trivy is an open-source vulnerability scanner specifically designed to scan container images, filesystems, and Git repositories for CVEs and misconfigurations. It integrates directly with container registries and CI/CD pipelines, making it the go-to tool for image security in cloud-native environments. Unlike the other options, Trivy's core function is vulnerability detection, not access control or runtime enforcement.

A VPC endpoint for S3 (gateway endpoint) allows resources in a VPC, including Lambda functions, to reach S3 privately without traversing the internet, NAT, or an internet gateway. Traffic stays on the AWS backbone and can be controlled with endpoint policies.

Running a container as root with privileged mode enabled grants the container almost all the capabilities of the host's root user, including access to host devices and kernel features. This significantly increases the attack surface, making it easier for an attacker to exploit kernel vulnerabilities or misconfigurations to escape the container and gain control of the host OS. While other risks exist, container escape is the most critical because it compromises the entire node and potentially the whole cluster.

CAP_SYS_MODULE is the Linux capability that permits a process to load and unload kernel modules via init_module() and delete_module() syscalls. Dropping it from a container's capability set prevents the containerized process from inserting malicious kernel code, which would otherwise be a direct path to host compromise. This is a standard hardening step in container security profiles (e.g., Docker's default seccomp/capability drop list).

Security groups are stateful virtual firewalls that control inbound and outbound traffic for AWS resources such as ALBs and EC2 instances. They are the correct tool to allow HTTP/HTTPS to an ALB and to restrict EC2 instances to only accept traffic from the ALB. Network ACLs operate at the subnet level and are stateless, AWS WAF is for layer 7 protection, and AWS Shield is for DDoS mitigation, so none of these fulfill the basic network access control requirement.

A VM escape is the class of attack where code running inside a guest VM exploits a vulnerability in the hypervisor (or virtual hardware emulation) to execute on the host. Because the hypervisor is the trust boundary, the primary mitigation is keeping it patched against known escape CVEs (e.g., VENOM, Xen XSA advisories). Regular hypervisor patching closes the specific flaws attackers leverage to break isolation.

Cryptographic erasure depends entirely on the irrecoverability of the key material protecting the drive. Only destroying the wrapping key that protects the media encryption key ensures that ciphertext on retired media can never be decrypted, which is precisely the guarantee a healthcare tenant needs for decommissioned storage.

Seccomp (secure computing mode) profiles restrict the system calls a container can make to the host kernel, directly reducing the kernel attack surface. By filtering out dangerous syscalls, seccomp is the most effective control for preventing a compromised container from exploiting kernel vulnerabilities. It operates at the syscall boundary, which is the primary interface between containers and the host kernel.

Placing the database tier in a private subnet with a security group that only allows traffic from the application tier's security group enforces both network-layer isolation (no route to the internet) and identity-based access control (SG-to-SG referencing). This is the AWS-recommended pattern for three-tier architectures because it minimizes the attack surface and prevents lateral movement from compromised web-tier instances. The database has no public IP and no route to an internet gateway, so it cannot be reached directly from outside the VPC.

The auditors require customer-exclusive key custody in a hardware security module plus the ability to revoke access and render disks unreadable. Azure Key Vault Managed HSM supplies single-tenant, hardware-backed key storage, and Azure Disk Encryption wraps the volume keys with a customer key from that HSM. Disabling or revoking the key-encryption key effectively crypto-shreds the disks, which platform-managed or software-protected keys cannot achieve.

The pipeline identity combines the power to weaken production network controls with the power to read protected secrets, so a single compromised credential can both disable defenses and steal data. Enforcing separation of duties through least-privilege IAM roles splits these capabilities across distinct identities, removing the toxic combination the review uncovered.

The requirement is for customer-controlled keys stored in a dedicated HSM separate from the cloud provider's default HSM, with immediate revocation. AWS KMS custom key store backed by AWS CloudHSM provides exactly this: you control the HSM cluster, and you can revoke access by disassociating the key or deleting it. Other options either use provider-managed HSMs or lack HSM separation.

In a Type 1 (bare-metal) hypervisor multi-tenant architecture, the hypervisor is the highest-privilege software layer controlling all guest VMs, memory, and virtual devices. A VM escape exploits a hypervisor or virtual-device vulnerability to break out of the guest's isolation boundary and execute code at the hypervisor level, compromising every other tenant on that host. This is the primary and most severe security risk because it defeats the fundamental tenant-isolation guarantee that multi-tenancy depends on.

NACLs (Network Access Control Lists) are stateless firewalls that operate at the subnet level and support both allow and deny rules. Security groups are stateful and only support allow rules at the instance level.

AWS Organizations is designed to centrally manage multiple AWS accounts, apply service control policies (SCPs) to enforce security boundaries, and simplify billing. It enables logical isolation by placing each tenant in a separate account while allowing centralized security governance. The other services provide access management, governance automation, or resource sharing but do not fulfill the core requirement of central account management and policy enforcement.