Certified Cloud Security Professional (CCSP)Cloud Security OperationsEasy
A cloud customer is performing a security assessment of their IaaS environment. They discover several virtual machines (VMs) with default administrator passwords that have not been changed. This finding indicates a failure in which aspect of cloud security operations?
- ACloud Security Auditing
- BCloud Security Monitoring
- CCloud Security Configuration Management
- DCloud Incident Response
Show answer & explanationAnswer & explanation
Correct answer: C. Cloud Security Configuration Management
Using default administrator passwords indicates a failure in establishing and enforcing secure configuration baselines for VMs, which is a core function of cloud security configuration management.
Why the other options are wrong
- A. Auditing would identify the misconfiguration, but the failure itself lies in the management process that allowed it.
- B. Monitoring would detect activity post-compromise, but not the misconfiguration itself.
- D. Incident response deals with reactive measures after a security event, not proactive configuration hardening.
Cloud Security Configuration Management
The process of establishing, maintaining, and enforcing consistent security configurations across all cloud resources (VMs, networks, databases, etc.) to minimize vulnerabilities and ensure compliance.
- Involves defining secure baselines.
- Automates deployment of secure configurations.
- Continuously monitors for configuration drift.
Memory trick: Configuration management keeps settings locked down, like a safe.