Penetration Testing in Cloud CCSE Practice Questions (Page 11)

Questions 51–52

1. 51expert · hard

   A company uses a SaaS CRM system and wants to conduct a penetration test to assess the security of its data within the application. The company has a contract with the SaaS provider that includes a shared responsibility matrix. Which testing activity is most likely permitted under the shared responsibility model?

   • APerforming a denial-of-service attack on the CRM to test its availability.
   • BAttempting to access other tenants' data by exploiting the CRM's multi-tenancy architecture.
   • CScanning the CRM provider's infrastructure for vulnerabilities to assess the provider's security posture.
   • DTesting the company's user accounts and roles within the CRM to identify privilege escalation vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A company operates a private cloud that is hosted on-premises and also uses a public cloud for disaster recovery. The security team wants to perform a penetration test that covers both environments. The team has limited time and budget. What is the most efficient approach to ensure both environments are tested appropriately?

   • APerform the same full test on both environments to ensure consistency.
   • BPrioritize testing the public cloud environment because it is more exposed to external threats, and perform a lighter test on the private cloud.
   • COutsource the public cloud test to a third party and test the private cloud internally.
   • DTest the private cloud first because it contains sensitive data, and skip the public cloud test to save time.
   Reveal Solution Discussion Select an answer first