Penetration Testing in Cloud CCSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following best defines the scope of a cloud penetration test?

   • AOnly the virtual machines and storage, excluding network and identity services.
   • BThe entire cloud provider's infrastructure, including all regions and services.
   • CThe customer's own cloud resources and configurations, as permitted by the provider's testing policy.
   • DAny resource that is publicly accessible, regardless of ownership.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is moving from an on-premises data center to a public cloud IaaS environment. The security team wants to conduct a penetration test that covers both the legacy on-premises network and the new cloud environment. Which testing consideration is most important?

   • AThe on-premises test must be conducted by an external firm, while the cloud test can be done internally.
   • BThe on-premises test requires no authorization because it is internal, while the cloud test requires a formal contract.
   • CThe cloud environment requires provider authorization and may have restrictions on testing certain services, while the on-premises environment is fully under the company's control.
   • DThe cloud test is more limited because the provider owns all security controls.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security consultant is hired to test a SaaS application that runs on a public cloud. The client wants the consultant to verify that the application's authentication and authorization controls are secure. Which testing activity is within the consultant's scope under the shared responsibility model?

   • AScanning the underlying hypervisor for known vulnerabilities to assess the provider's infrastructure.
   • BAttempting to bypass the application's login and role-based access controls using crafted API requests.
   • CPerforming a network vulnerability scan of the provider's internal management network.
   • DReviewing the provider's physical data center security controls and badge access logs.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In the exploitation phase of a cloud penetration test, what is the primary goal?

   • ATo maintain persistence in the environment
   • BTo document all findings in a report
   • CTo identify open ports and services
   • DTo gain unauthorized access to a system or resource
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which phase of cloud penetration testing involves gathering information about the target cloud environment without actively exploiting it?

   • AReconnaissance
   • BExploitation
   • CScanning
   • DPost-exploitation
   Reveal Solution Discussion Select an answer first