Question

A cloud security architect is designing controls for the management plane of an IaaS environment. Administrators currently connect directly to the provider's web console and API endpoints using long-lived static credentials from their laptops, which may be on untrusted networks. Compromise of a single administrator account would allow an attacker to spin up, delete, or reconfigure the entire virtual infrastructure. Which control set most directly reduces the risk of management-plane compromise?

Accepted Answer

Require phishing-resistant MFA for all privileged accounts, enforce role-based least-privilege on management APIs, and route administrative access through a hardened, logged bastion/jump host

Answer

Enable full-disk encryption on all administrator laptops and mandate quarterly password rotation for console credentials

Answer

Deploy a web application firewall in front of the guest VMs and enable network flow logging on tenant subnets

Answer

Increase VM snapshot frequency and replicate backups to a second region to enable rapid recovery after an incident