Cloud-Security-Professional Cloud Security Professional Practice Questions

Cortex Cloud's runtime protection includes an admission controller that intercepts deployment requests. Even if an image was scanned and deemed safe in the past, the admission controller performs a final check against the very latest threat intelligence and vulnerability data at the moment of deployment. When the new zero-day vulnerability is added to the database, the admission controller will identify it in the image and block the container from running, enforcing the security policy.

Once a secret is exposed, it must be considered compromised. Even if the commit is removed from the repository's history, it may have been cloned or cached. The only way to guarantee the credential cannot be abused is to revoke it at the source, in this case, by deactivating and deleting the access key in AWS IAM. This is the most critical and time-sensitive step. Removing the secret from Git history is also necessary but is secondary to revoking the credential itself.

The correct way to handle intentional deviations from a security policy is to create a documented exception. In Cortex Cloud, you can create an exception for a specific resource against a specific policy. This requires a justification, which creates an audit trail, and allows for setting an expiration date, prompting a review in the future. This approach reduces alert noise while ensuring the business exception is tracked and managed.

Data poisoning is an attack where an adversary intentionally pollutes the training data of an ML model to compromise its integrity. The AI-SPM module helps mitigate this by scanning training data sources for anomalies, monitoring the integrity of the ML pipeline, and detecting unusual shifts in model behavior that could indicate a poisoning attack has occurred.

Cloud Detection and Response (CDR) is specifically designed to correlate data from multiple sources, including posture (CSPM), identity (CIEM), and runtime (CWP). Its Attack Path Analysis feature visualizes how an attacker could chain together different weaknesses—like a public-facing asset with a vulnerability, an over-privileged IAM role, and a runtime exploit—to achieve their objective. This provides the exact context the analyst needs.

Cortex Cloud often relies on specific configurations for resource discovery, especially in large environments. A common practice is to configure the cloud account onboarding to only discover and scan resources that have a specific tag. This prevents accidental scanning of non-production or irrelevant assets. If new buckets are created without this tag, the DSPM scanner will ignore them, which is the most probable cause given that existing buckets are scanned correctly.

The readOnlyRootFilesystem: true setting in a pod's security context directly enforces an immutable file system at the container level. This prevents any process, even one running as root inside the container, from writing to the root filesystem. This is a critical security control that aligns with the CIS Benchmark for Kubernetes and mitigates many runtime threats by preventing attackers from modifying binaries or configuration files.

The Cortex Cloud Serverless Defender is specifically engineered to protect serverless functions like AWS Lambda. It is deployed as a Lambda layer, which allows it to be attached to the function without modifying the core application code. This layer instruments the runtime environment to monitor for and block malicious activities, enforce security policies, and provide visibility into vulnerabilities within the function's dependencies.

The most secure and proper way to fix a vulnerability in a transitive dependency is to update the direct dependency that pulls it in. Modern package managers will resolve the dependency tree and pull a patched, non-vulnerable version of the transitive dependency if one is available in the updated direct package. This addresses the root cause rather than simply suppressing an alert, ensuring the code is actually secure.