Penetration Testing in Cloud CCSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   After completing a cloud penetration test, a tester finds that an Azure storage account has a misconfigured firewall rule that allows public access. The client wants a remediation recommendation that is both effective and least disruptive. What should the tester recommend?

   • ADelete the storage account and recreate it with default settings.
   • BEnable Azure Defender for Storage to automatically block all public access.
   • CRestrict the storage account firewall to only allow access from specific virtual networks and trusted IP ranges.
   • DMove the storage account to a different region to avoid the misconfiguration.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A penetration tester is performing reconnaissance on a public cloud environment. The tester has identified an S3 bucket that appears to be publicly accessible. What is the most appropriate next step in the penetration testing methodology?

   • ASkip the bucket and continue reconnaissance to find other potential targets.
   • BImmediately report the bucket as a critical finding without accessing it to avoid legal issues.
   • CMove to exploitation by attempting to write a test file to the bucket.
   • DAttempt to list and access the bucket's contents to confirm the misconfiguration and assess the exposure.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When testing cloud APIs, which technique is commonly used to identify insecure endpoints?

   • APort scanning with Nmap
   • BFuzzing the API with unexpected inputs
   • CAnalyzing network traffic with Wireshark
   • DChecking for open ports on the API server
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How does a private cloud deployment typically affect the penetration testing approach compared to a public cloud?

   • ATesting is not required because the cloud is private.
   • BThe organization has more control over the testing environment and can conduct a wider range of tests.
   • CTesting is limited to the application layer only.
   • DThe provider's terms of service restrict all testing activities.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A penetration tester is following the PTES methodology to test a cloud-based web application. The tester has completed the reconnaissance and scanning phases and has identified a potential SQL injection vulnerability in an API endpoint. According to PTES, what is the next phase the tester should execute?

   • ARisk assessment, by calculating the business impact of the SQL injection without exploiting it.
   • BExploitation, by attempting to exploit the SQL injection to gain unauthorized access or extract data.
   • CPost-exploitation, by immediately assessing the impact of the SQL injection on the underlying cloud infrastructure.
   • DReporting, by documenting the SQL injection as a finding without further testing.
   Reveal Solution Discussion Select an answer first