312-50 Question 433
Single answer▪ Cloud Computing ConceptsDuring an authorized assessment of a company's public cloud environment, a CEH discovers that several virtual machines in the same virtual network can reach each other over internal IP addresses, even though no host-based firewall rules are configured on the instances. The company believes the cloud provider automatically isolates every VM from all others by default. Which action should the ethical hacker recommend FIRST to reduce the risk of unauthorized lateral movement between cloud workloads while preserving required application communication?
- A
Implement and review cloud-native network segmentation controls such as security groups or network security groups to restrict east-west traffic to only required ports and sources
- B
Rely on the hypervisor because tenant-to-tenant isolation automatically prevents any VM-to-VM communication inside the same customer virtual network
- C
Disable all internal private IP addressing so workloads can communicate only through public IP addresses monitored by perimeter firewalls
- D
Move all workloads to a SaaS platform because SaaS removes the need for any network access control configuration by the customer
Show answer and explanation
Correct answer: A
Explanation
This question tests understanding of cloud computing concepts in a practical security context, especially shared responsibility and segmentation in customer-managed cloud networks. In major public clouds, the provider secures the underlying infrastructure, but the customer is typically responsible for configuring access controls for workloads, subnets, and virtual networks. A common mistake is assuming that because the provider uses a hypervisor and multi-tenant isolation, internal segmentation within a customer's own environment is automatic. In practice, ethical hackers should look for overly permissive east-west connectivity because it enables lateral movement after compromise. The best first recommendation is to implement least-privilege network policy using cloud-native controls such as AWS Security Groups/NACLs, Azure NSGs, or similar mechanisms. This aligns with guidance from major cloud providers and industry best practices, including the cloud shared responsibility model and zero trust principles, which emphasize explicit restriction of internal traffic rather than implicit trust within a virtual network.
- A. Correct.
Correct. In cloud environments, workloads within the same customer virtual network or VPC/VNet are often able to communicate unless explicitly restricted. Cloud-native controls such as AWS Security Groups and NACLs, Azure Network Security Groups, or equivalent firewall policies should be used to enforce least privilege for east-west traffic. This is the most direct and practical first step to reduce lateral movement while still allowing necessary application flows.
- B. Incorrect.
Incorrect. Hypervisor isolation is primarily intended to separate different tenants and protect the provider's infrastructure boundary, but it does not mean workloads within the same customer-controlled virtual network are automatically segmented from one another. This option reflects a common misconception that provider-managed virtualization replaces customer responsibility for internal network policy.
- C. Incorrect.
Incorrect. Private IP communication is a normal and recommended design pattern in cloud environments. Forcing all traffic over public IP space would increase attack surface, add complexity, and violate common cloud security best practices. The issue is not the existence of private addressing; it is the absence of granular access controls between workloads.
- D. Incorrect.
Incorrect. Moving to SaaS is not an immediate or realistic mitigation for a segmentation weakness in an IaaS or PaaS deployment. In addition, SaaS does not eliminate all customer security responsibilities; responsibilities shift depending on the shared responsibility model. This option confuses service model selection with tactical remediation.