Cloud Platform & Infrastructure Security practice questions

When customers cannot audit a provider's data centers, independent attestation reports provide assurance about physical controls.

Providers do not let each tenant inspect shared facilities, so customers rely on third-party audits. A SOC 2 Type II report covers the security trust services criteria, including physical access, and tests whether the controls operated effectively over a review period. A Type I report only covers design at a point in time, and a SOC 3 is a public summary that lacks the detail. Scanning the bank's own servers tests a different layer entirely.

1. Note the constraint: no site visits, so assurance must come from a third party.
2. Pick evidence that covers physical controls and tests operation over time.
3. Rule out point-in-time (Type I) and summary (SOC 3) reports, and tests of the wrong layer.

Exam tip: No site visit? A SOC 2 Type II report is the detailed, over-time evidence of the provider's physical controls.

A hardware root of trust lets a host prove its boot chain is unaltered before it receives workloads.

The requirement is proof to another system, not just local enforcement. Measured boot extends a TPM's registers with a hash of each component as it loads, and remote attestation lets the management plane compare the signed measurements with expected values before scheduling tenants. Secure boot is the near-twin: it stops unsigned code from loading, but it does not give the scheduler verifiable evidence. Guest agents and HSMs work at other layers.

1. Note that the host must prove its state to the management plane.
2. Recall that the TPM stores measurements of each boot stage.
3. Choose the capability that reports those measurements for remote verification.

Exam tip: Secure boot enforces locally; measured boot plus attestation proves the boot chain to someone else.

Out-of-band management controllers sit below the hypervisor and must be isolated from tenant networks.

A baseboard management controller can power-cycle the host, mount media and change firmware regardless of what runs on the host, so an attacker who reaches it bypasses every hypervisor control. Two facts decide the answer: hardening the hypervisor does nothing for this interface, and the root cause is network reachability. Isolating the controllers on a restricted management network removes the path; interface hardening and detection still leave tenant workloads one exploit away.

1. Locate the controller in the stack: it is hardware management below the hypervisor.
2. Recognise that hypervisor hardening cannot protect it.
3. Address the root cause, reachability from tenant networks, before secondary hardening.

Exam tip: Hardware management interfaces belong on an isolated management network, never on a network tenants can reach.

SDN separates the control plane, which decides, from the data plane, which forwards.

Software-defined networking moves the decision-making out of individual switches into a central controller. The controller computes how traffic should flow and programs the data-plane devices through southbound interfaces, while orchestration tools reach the controller through northbound APIs. The forwarding tables and virtual switches only carry out what the controller decided.

1. Separate deciding from forwarding.
2. Place deciding in the control plane, which the controller provides.
3. Recognise the APIs and tables as interfaces and outputs, not the decision-maker.

Exam tip: In SDN, the controller decides and programs; the data plane only forwards.

Centralizing network decisions in an SDN controller also centralizes the risk.

SDN's strength, one controller programming the whole network, is also its main weakness: the controller and the API that drives it become a single point of compromise for every tenant segment. Any single switch, virtual or physical, affects only what passes through it. That is why the controller cluster needs the strongest access control, isolation and change logging in the design.

1. Ask where the forwarding rules originate.
2. Compare the blast radius of each component.
3. Choose the component whose compromise reaches every tenant.

Exam tip: Protect the SDN controller and its northbound API like the management plane: they steer every tenant's traffic.

Overlay networks extend tenant segmentation beyond the VLAN identifier limit.

A VLAN tag carries a 12-bit ID, leaving about 4,094 usable segments, which large multi-tenant clouds exhaust. VXLAN wraps each tenant's layer 2 frames in UDP with a 24-bit VXLAN network identifier, so the same physical network can carry about 16 million isolated segments. Private VLANs, port authentication and security groups are real controls, but none of them adds layer 2 segments.

1. Recognise the limit: 12-bit VLAN IDs.
2. Look for a technology that carries a larger segment identifier.
3. Rule out controls that filter or authenticate rather than segment.

Exam tip: VLANs top out near 4,094 segments; VXLAN's 24-bit identifier reaches about 16 million.