Penetration Testing in Cloud CCSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   When adapting the OWASP Testing Guide for cloud penetration testing, what additional area must be included beyond traditional web application tests?

   • ATesting the physical security of the data center
   • BTesting the cloud service provider's internal network
   • CTesting the configuration of cloud-specific services like storage buckets and IAM policies
   • DTesting the provider's hypervisor for vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A multinational company operates a hybrid cloud: a private cloud in the EU for HR data and a public cloud (Azure) in the US for customer-facing applications. The security team plans a penetration test that will involve testing the HR application in the private cloud and the public web app in Azure. The company has offices in the EU and the US. Which consideration is most critical for the test's legal and compliance posture?

   • AOnly obtain authorization from the US office because the public cloud is in the US and the private cloud is internal.
   • BEnsure that the test does not transfer personal data of EU citizens outside the EU without a valid legal basis, and obtain authorization from both the private cloud owner and Microsoft.
   • CPerform the test from a US-based tester to avoid EU data protection laws.
   • DUse only synthetic data in the test to avoid any data protection concerns.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which cloud service model typically gives the customer the least control over the underlying infrastructure, affecting the scope of penetration testing?

   • APaaS
   • BIaaS
   • CSaaS
   • DOn-premises
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which standard penetration testing methodology is commonly adapted for cloud environments by emphasizing business processes and risk assessment?

   • ANIST SP 800-115
   • BISO/IEC 27001
   • COWASP Testing Guide
   • DPTES (Penetration Testing Execution Standard)
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   In an IaaS model, which of the following is the customer responsible for testing?

   • AThe physical servers and network infrastructure
   • BThe hypervisor and virtualization layer
   • CThe storage hardware and network switches
   • DThe virtual machines, operating systems, and applications
   Reveal Solution Discussion Select an answer first