Cloud-Based Attacks PT0-003 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which attack vector is commonly used to reach the cloud metadata service from an application running in a cloud instance?

   • ACross-Site Scripting (XSS)
   • BMan-in-the-Middle (MITM) attack
   • CSQL injection
   • DServer-Side Request Forgery (SSRF)
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a recommended container security best practice to reduce the risk of container escape?

   • AMounting the host filesystem into the container
   • BUsing the default Docker bridge network
   • CRunning the container with the `--privileged` flag
   • DDisabling Linux capabilities that are not required
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A cloud security team is reviewing IAM policies and finds that a developer's role has the following policy attached: { "Effect": "Allow", "Action": "s3:*", "Resource": "*" }. What is the primary security risk of this configuration?

   • AThe policy allows the developer to delete any S3 bucket in the account.
   • BThe policy grants overly broad permissions, allowing the developer to perform any S3 action on any bucket.
   • CThe policy only allows read access to S3 buckets.
   • DThe policy is fine because S3 is not a critical service.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security auditor is reviewing an Azure subscription and finds that a user has been assigned the 'Owner' role on a resource group. What is the most significant risk associated with this assignment?

   • AThe user can manage all resources within the resource group, including granting access to others.
   • BThe user can only view resources but cannot make changes.
   • CThe user can only delete resources within the resource group.
   • DThe user can read all secrets in the Key Vault.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A penetration tester is assessing a Docker host. The tester finds a container that has the host's /var/run/docker.sock mounted. What is the most direct way to achieve host-level access?

   • AUse the Docker socket to create a new container that mounts the host's root filesystem.
   • BUse nsenter to enter the host's PID namespace.
   • CUse a kernel exploit to break out of the container.
   • DRead the container's environment variables to find host credentials.
   Reveal Solution Discussion Select an answer first