Certified Cloud Security Professional (CCSP)Cloud Security OperationsMedium
A cloud customer is performing a security audit of their IaaS environment. The audit team needs to verify that all virtual machines (VMs) are using approved, hardened operating system images and that no unauthorized software has been installed. They also need to ensure that security patches are applied consistently. What type of cloud security assessment would be most effective for continuously monitoring and enforcing these configuration standards?
- AVulnerability scanning.
- BApplication security testing (AST).
- CPenetration testing.
- DSecurity configuration management and compliance auditing.
Show answer & explanationAnswer & explanation
Correct answer: D. Security configuration management and compliance auditing.
Security configuration management and compliance auditing continuously monitor cloud resources against defined baselines and regulatory requirements. This includes verifying OS image hardening, authorized software, and patch levels, ensuring ongoing adherence to security standards.
Why the other options are wrong
- A. Vulnerability scanning identifies known weaknesses, but it's different from verifying adherence to specific configuration baselines and approved software lists.
- B. AST focuses on vulnerabilities within applications themselves, not the underlying VM operating system or installed software.
- C. Penetration testing simulates attacks to find vulnerabilities but doesn't continuously enforce configuration standards.
Cloud Security Configuration Management
The process of defining, implementing, and continuously monitoring security configurations for cloud resources to ensure compliance with policies and standards.
- Automates the enforcement of security baselines.
- Detects and remediates configuration drifts.
- Crucial for maintaining a consistent security posture and compliance.
Memory trick: Configuration Management is the 'Blueprint Inspector' for cloud settings.