After compromising a cloud environment, an attacker creates a new IAM user with a strong password and attaches an administrative policy. The attacker also enables multi-factor authentication on the new user. What is the primary purpose of this action?

To escalate privileges from a lower-privileged account.

To establish persistence by creating a backdoor account.

To perform lateral movement to other cloud services.

To evade logging by using a legitimate account.

A security team is investigating a cloud breach. The attacker stole a user's OAuth token and used it to access cloud resources. The attacker then created a new service principal with elevated privileges and assigned it to a resource group. The attacker also modified the audit log retention policy to reduce the retention period. Which combination of techniques did the attacker use?

Privilege escalation, lateral movement, and data exfiltration

Credential theft, persistence, and logging evasion

Misconfiguration exploitation, data exfiltration, and persistence

Credential theft, privilege escalation, and lateral movement

What is the purpose of using a covert channel for cloud data exfiltration?

To hide the exfiltration traffic from security monitoring

To avoid cloud provider charges

To increase the speed of data transfer

To encrypt the data during transfer

A penetration tester is performing reconnaissance against a target organization that uses AWS. The tester discovers a public S3 bucket that contains backup files with database connection strings. What is the most appropriate next step in the cloud hacking methodology?

Use the connection strings to access the database and then attempt to pivot to other cloud resources.

Attempt to brute-force the AWS root account credentials using the discovered connection strings.

Immediately escalate privileges by modifying the IAM policy of the discovered bucket.

Disable CloudTrail logging to avoid detection before proceeding with further attacks.

Why might an attacker disable cloud audit trails as an evasion technique?

To prevent the recording of their malicious actions

To comply with cloud provider policies

EC-CouncilCertified Ethical Hacker

Domain 8Objective 3

Cloud Hacking Methodology CEH Practice Questions (Page 7)

Part of the Cloud Computing domain, which makes up ~7% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~7–11 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 31–35

31application · medium
After compromising a cloud environment, an attacker creates a new IAM user with a strong password and attaches an administrative policy. The attacker also enables multi-factor authentication on the new user. What is the primary purpose of this action?
Select an answer first
32expert · hard
A security team is investigating a cloud breach. The attacker stole a user's OAuth token and used it to access cloud resources. The attacker then created a new service principal with elevated privileges and assigned it to a resource group. The attacker also modified the audit log retention policy to reduce the retention period. Which combination of techniques did the attacker use?
Select an answer first
33foundation · easy
What is the purpose of using a covert channel for cloud data exfiltration?
Select an answer first
34application · medium
A penetration tester is performing reconnaissance against a target organization that uses AWS. The tester discovers a public S3 bucket that contains backup files with database connection strings. What is the most appropriate next step in the cloud hacking methodology?
Select an answer first
35foundation · easy
Why might an attacker disable cloud audit trails as an evasion technique?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.