8.0 Cloud Computing CEH Practice Quiz

• A. Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS)
• B. Public, Private, and Hybrid
• C. Compute, Storage, and Networking
• D. On-premises, Colocation, and Managed Services

NIST SP 800-145 defines three cloud service models: IaaS (provider manages physical infrastructure and virtualization; customer manages OS, middleware, and applications), PaaS (provider manages OS and runtime; customer manages applications and data), and SaaS (provider manages the entire stack; customer manages only user-level configuration and data).

• A. Community cloud, shared infrastructure for organizations with common interests
• B. Public cloud, all resources hosted by a third-party provider
• C. Hybrid cloud, on-premises and public cloud resources connected and orchestrated together
• D. Multi-cloud, simultaneous use of multiple public cloud providers

A hybrid cloud integrates on-premises (or private cloud) infrastructure with public cloud resources, connected via dedicated links (such as AWS Direct Connect or Azure ExpressRoute) or VPN. This allows organizations to keep sensitive workloads on-premises while leveraging public cloud capacity for scalability, or to burst to the cloud during peak demand.

• A. IaaS, because it provides the most infrastructure flexibility
• B. PaaS, because the provider manages the OS, runtime, and middleware
• C. SaaS, because the provider manages the complete application stack
• D. FaaS, because functions eliminate all server management entirely

PaaS (Platform as a Service) is specifically designed for this use case, the cloud provider manages the OS, web server, runtime environment, and middleware, while the customer deploys and manages only the application code and its data. AWS Elastic Beanstalk, Google App Engine, and Heroku are common PaaS examples.

• A. Public cloud with VPC isolation and dedicated instances
• B. Community cloud shared with other regulated financial institutions
• C. Hybrid cloud splitting workloads between on-premises and public cloud
• D. Private cloud hosted by a managed service provider on dedicated hardware

A private cloud hosted by a managed service provider (MSP) on dedicated hardware meets all three constraints: (1) dedicated hardware satisfies the regulatory isolation requirement, (2) no shared compute with other organizations, and (3) the MSP manages the infrastructure, eliminating on-premises capital expenditure. This is increasingly common among regulated financial institutions using providers such as IBM Cloud or private managed colocation services.

• A. Containers share the host OS kernel and isolate at the process level; VMs run separate guest OS instances on a hypervisor
• B. Containers are slower than VMs due to the additional abstraction layer between the application and hardware
• C. VMs share the host OS kernel while containers each run their own isolated OS kernel
• D. Containers require a Type-1 hypervisor while VMs can run directly on bare metal hardware

Containers (e.g., Docker) share the host operating system's kernel and use Linux namespaces and cgroups to isolate processes, filesystems, and network stacks at the OS level. Virtual machines run a complete separate guest OS on top of a hypervisor (Type-1 or Type-2), with no kernel sharing. This makes containers lighter and faster to start, but means a kernel vulnerability can potentially affect all containers on the host.

• A. Lambda functions with AdministratorAccess IAM roles cannot be invoked by API Gateway and will fail at runtime
• B. Lambda functions with broad IAM roles consume significantly more memory and incur higher execution costs
• C. If any function is compromised via injection or vulnerable dependency, the attacker gains full administrative control over the entire AWS account
• D. AdministratorAccess roles cause Lambda functions to exceed the maximum execution timeout of 15 minutes

Lambda functions with AdministratorAccess inherit those permissions at runtime. If an attacker exploits a vulnerability in the function (event injection, vulnerable npm/pip dependency, SSRF to metadata service), they can call any AWS API with full administrative rights, creating backdoor IAM users, exfiltrating all S3 data, deleting resources, or pivoting to other services. The blast radius of a single compromised function equals the blast radius of a compromised AWS root account. OWASP Serverless Top 10 specifically lists over-privileged function permissions as a critical risk (SAS-7).

• A. Server-side encryption was disabled on the S3 bucket, making objects accessible without decryption keys
• B. S3 bucket versioning was not enabled, allowing objects to be overwritten without audit trails
• C. The S3 Block Public Access settings were disabled and a bucket policy or ACL grants s3:GetObject to the wildcard principal
• D. The S3 bucket's VPC endpoint routing was configured incorrectly, bypassing private network access controls

AWS S3 public access is controlled by two layers: (1) S3 Block Public Access settings (account-level and bucket-level toggles that override permissive policies) and (2) bucket policies or ACLs that grant s3:GetObject to Principal '*' (all principals). Both must be permissive for a bucket to be publicly accessible without authentication. This combination. Block Public Access disabled and a wildcard-principal bucket policy, is the defining misconfiguration behind S3 data exposure incidents.

• A. Insecure Direct Object Reference (IDOR), the attacker is accessing another user's file
• B. Event injection leading to OS command injection in the serverless function
• C. Server-Side Request Forgery (SSRF), the function is making a request to an attacker-controlled server
• D. XML External Entity (XXE) injection, the filename parameter is processed as XML input

This is a classic event injection attack leading to OS command injection (OWASP Serverless Top 10: SAS-3. Functions Event-Data Injection). The unvalidated filename parameter is passed directly into a shell command. The attacker injects a semicolon to terminate the convert command and executes arbitrary shell commands under the Lambda function's execution role. In serverless environments, this is particularly dangerous because the function may have cloud API permissions attached.