Penetration Testing in Cloud CCSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which tool is specifically designed for testing the security of containerized applications?

   • ATrivy
   • BBurp Suite
   • CNmap
   • DWireshark
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which compliance requirement is particularly relevant when penetration testing involves data that is subject to GDPR?

   • ADeleting all test data immediately after the test is completed.
   • BEnsuring that personal data is handled in compliance with GDPR principles, including minimization and security.
   • CObtaining explicit consent from the data subjects whose data is used in the test.
   • DEnsuring that all test data is stored in the same region as the production data.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary legal requirement before conducting a penetration test against a cloud environment?

   • AObtaining written authorization from the cloud service provider.
   • BRegistering the test with the local government.
   • CNotifying all users of the cloud service.
   • DPurchasing a special testing license.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   After completing a cloud penetration test, a tester is writing the report. The tester found a misconfigured identity and access management (IAM) role that allows any user in the account to assume a highly privileged role. What is the most appropriate remediation recommendation to include in the report?

   • ARestrict the trust policy of the role to only the specific principals that require access, and implement conditional access policies.
   • BAdvise the client to monitor the role usage and report any suspicious activity.
   • CRecommend using a longer password for the role's access keys.
   • DDelete the role immediately and recreate it with the same permissions.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A multinational company operates a hybrid cloud with a private cloud in Germany and a public cloud in the United States. The company is subject to GDPR and wants to conduct a penetration test that includes both environments. The test will involve transferring test data between the two environments. Which consideration is most critical for the test to remain compliant?

   • AEnsure that any personal data used in the test is anonymized or pseudonymized before being transferred to the US.
   • BObtain approval from the US cloud provider before transferring any data.
   • CUse only synthetic data that does not represent real individuals.
   • DConduct the test only in the private cloud in Germany to avoid cross-border data transfer issues.
   Reveal Solution Discussion Select an answer first