Exam PT0-002 topic 1 question 131 discussion

Side-channel attacks in cloud environments rely on the ability to gain access that allows penetration testers to capture information by leveraging shared underlying hardware. Infrastructure as a service (IaaS) environments deploy multiple virtual machines on the same hardware platform, meaning that attackers may be able to use shared resources or compromise of the virtualization or containerization system itself to gain access to data without compromising the target system itself. It leverages a remnant data vulnerability when virtual drives are resized. Fortunately, the major players in the IaaS space have prevented this issue by using encrypted volumes and other techniques to ensure remnant data is no longer an issue. Despite this, side-channel attacks will always remain a concern while systems share underlying hardware.

The most concerning attack type to the company is D. Side Channel Attacks. Side channel attacks are a type of attack that allows an attacker to obtain privileged information (such as passwords, encryption keys, etc.) by exploiting the physical characteristics of the computer system. For example, an attacker could measure the power consumption of the system over time to infer the encryption key used. In this case, the company is concerned about the protection of its VMs, which are hosted in a datacenter with other companies sharing physical resources. Thus, a side channel attack is the most concerning attack type as it could potentially allow an attacker to gain access to the VMs without needing to compromise the security of the cloud provider. The other options are not as concerning as side channel attacks, as they typically involve the attacker gaining access to a user's session (Session Riding) or hijacking a domain name (Cybersquatting), or overwhelming a system with malicious data (Data Flooding).

https://www.techtarget.com/searchsecurity/definition/side-channel-attack#:~:text=Side%2Dchannel%20attacks%20can%20even,share%20the%20same%20physical%20hardware