Cloud Hacking Methodology CEH Practice Questions (Page 5)

Questions 21–25

1. 21application · hard

   After compromising an AWS account, an attacker wants to establish persistence that is difficult to detect and will survive a password reset on the root user. Which of the following is the MOST effective persistence mechanism?

   • ACreate a new access key for the root user and store it in a secure location.
   • BCreate a new IAM user with AdministratorAccess and add it to the 'admins' group.
   • CModify the trust policy of an existing IAM role to allow the attacker's external AWS account to assume it.
   • DDeploy a Lambda function that runs on a schedule and creates a new IAM user if the current one is deleted.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An attacker has compromised a low-privileged IAM user in AWS. The user has permissions to list S3 buckets and read objects in a specific bucket. The attacker discovers that the bucket contains database credentials. The attacker wants to move laterally to an RDS database. Which sequence of actions is most effective?

   • AUse the S3 bucket to host a malicious payload and wait for an admin to access it.
   • BAttempt to escalate privileges by modifying the IAM policy of the S3 bucket.
   • CRead the database credentials from the S3 bucket and use them to connect to the RDS instance.
   • DDisable the RDS instance's security group to allow direct access.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which cloud credential attack involves tricking users into revealing their login credentials through fake cloud login pages?

   • AToken theft
   • BCredential stuffing
   • CBrute force
   • DPhishing
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A penetration tester has gained access to an AWS EC2 instance with an IAM role attached. The role has permissions to list S3 buckets and read objects in a specific bucket. The tester wants to escalate privileges to gain administrative access. Which technique is most appropriate?

   • AModify the IAM policy of the instance's role directly from the instance.
   • BDisable the instance's security group to gain network-level access to other resources.
   • CBrute-force the root user password from the EC2 instance.
   • DUse the instance metadata service to retrieve temporary credentials and then attempt to assume a more privileged role.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of querying the cloud instance metadata service during reconnaissance?

   • ATo retrieve instance-specific information like security credentials and configuration
   • BTo map the organization's DNS records
   • CTo enumerate IAM users and roles
   • DTo discover the instance's public IP address
   Reveal Solution Discussion Select an answer first