Cloud Hacking Methodology CEH Practice Questions (Page 10)

Questions 46–48

1. 46application · medium

   An attacker has compromised a web application running on an AWS EC2 instance and obtained the instance's IAM role credentials. The attacker wants to move laterally to other resources in the same VPC. Which technique is most effective?

   • ADisable the VPC flow logs to avoid detection.
   • BPerform a port scan of the entire internet to find other cloud resources.
   • CModify the VPC's route tables to redirect traffic to the attacker's machine.
   • DUse the IAM credentials to list and access other EC2 instances and RDS databases in the VPC.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which cloud reconnaissance technique involves querying public DNS records and certificate transparency logs to discover cloud assets?

   • AAPI enumeration
   • BService discovery
   • CPublic asset mapping
   • DMetadata enumeration
   Reveal Solution Discussion Select an answer first
3. 48expert · hard

   A penetration tester is conducting a cloud assessment and has completed reconnaissance and enumeration. The tester has identified a misconfigured S3 bucket that allows public write access. The tester wants to gain access to the underlying AWS account. Which sequence of actions is most effective?

   • ADisable the bucket's logging to avoid detection.
   • BUpload a malicious file to the bucket and then use a separate vulnerability to execute it on a connected EC2 instance.
   • CUse the bucket's public write access to overwrite existing objects and deface the application.
   • DAttempt to escalate privileges by modifying the bucket policy.
   Reveal Solution Discussion Select an answer first