Skip to content
AI Security
Practice tests · 47 items

Cloud, Container & AI Infrastructure Security practice test

Cloud posture (CSPM/CNAPP), sensitive-data discovery (DSPM), infrastructure as code, container and Kubernetes controls, workload protection (CWPP) and runtime sensors. Follow identities, data and exposure through the AI infrastructure stack. The pool for this topic holds 12 easy, 21 medium and 14 hard items. Each answer comes with its reasoning and a link to the question or concept page it was drawn from.

Configure a test
Topic
Difficulty
Questions
12 in this pool · about 7 min
Reveal answers
Sign in to startFree account required · retakes favour new items

Sample items with answers

easy · sample
What do all containers on a Linux host share that virtual machines on a hypervisor do not?
A single shared filesystem, so every container can read the files that other containers write
✓The host kernel, so one kernel bug can break isolation for every container
One network stack, so containers can sniff each other's traffic
The same user accounts, so a password set in one container works in all the others

Containers are processes separated by namespaces and cgroups, all making system calls into one shared kernel. A VM runs its own guest kernel behind a hypervisor, a much smaller interface. That is why untrusted code usually gets a VM or microVM boundary, not a plain container.

easy · sample
Why is the cloud metadata endpoint the first target of SSRF on a cloud VM?
✓It can return temporary credentials for the role attached to the instance
It stores the database passwords for every application that runs inside the same account
It controls the account's DNS records
It holds the private TLS keys for every load balancer that fronts the application

The metadata service at 169.254.169.254 answers the instance itself, including role credentials. An SSRF that reaches it hands the attacker those credentials. AWS IMDSv2 requires a session token fetched with a PUT and a custom header, which most SSRF primitives cannot send.

After the test

Choosing from options is easier than reasoning it out in front of a panel. These pages make you reason it out: