Penetration Testing in Cloud CCSE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A penetration tester is using the OWASP Testing Guide to assess a web application hosted on a public cloud. The application uses a load balancer and auto-scaling. The tester wants to perform a thorough test without causing service disruption. Which approach is most appropriate?

   • ARun all tests at full intensity to ensure that the application is tested under maximum load.
   • BTest only the load balancer's configuration and skip application-level testing to avoid impact.
   • CCoordinate with the cloud team to test during a maintenance window and use rate-limiting to avoid overwhelming the auto-scaling group.
   • DDisable auto-scaling for the duration of the test to prevent scaling issues.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team is planning a penetration test for a new cloud application that uses a PaaS offering. The team wants to ensure the test is within the scope of the shared responsibility model. Which testing activity is appropriate for the team to perform?

   • AScanning the underlying operating system of the PaaS platform for vulnerabilities.
   • BAttempting to access other customers' data by exploiting the PaaS platform's isolation mechanisms.
   • CTesting the application's authentication and session management controls.
   • DPerforming a denial-of-service attack on the PaaS platform to test its resilience.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary difference between cloud penetration testing and traditional on-premises penetration testing?

   • ACloud testing involves validating the security of the provider's physical data centers.
   • BCloud testing must account for the shared responsibility model and the provider's terms of service.
   • CCloud testing focuses only on the customer's own resources and ignores the provider's infrastructure.
   • DCloud testing does not require any authorization from the cloud provider.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In a hybrid cloud deployment, what is a key consideration for penetration testing?

   • ATesting only the public cloud components because the private cloud is secure.
   • BTesting the connection between the private and public cloud environments.
   • CTesting only the private cloud components because the public cloud is managed by the provider.
   • DTesting the provider's physical data centers.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is planning a penetration test for its cloud environment, which includes IaaS, PaaS, and SaaS services. The company wants to ensure the test is comprehensive but also compliant with the shared responsibility model. Which approach best balances these requirements?

   • AUse a single testing methodology for all service models to simplify the process.
   • BTest all layers of the cloud stack, including the provider's infrastructure, to ensure no vulnerabilities are missed.
   • CDefine a test scope that covers the customer-controlled layers of each service model and obtain authorization for each layer.
   • DOnly test the SaaS application because it is the most visible to users.
   Reveal Solution Discussion Select an answer first