Cloud Hacking Methodology CEH Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the goal of cloud privilege escalation?

   • ATo gain higher-level permissions than originally assigned
   • BTo move laterally across the network
   • CTo exfiltrate data
   • DTo hide malicious activity from logs
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A penetration tester is conducting an assessment of a multi-cloud environment. The tester has completed reconnaissance and identified several potential misconfigurations. According to the cloud hacking methodology, what should the tester do next?

   • AImmediately exploit the misconfigurations to gain access.
   • BProceed to service enumeration to gather more details about the identified misconfigurations.
   • CEstablish persistence by creating backdoor accounts.
   • DExfiltrate data from the identified misconfigured storage.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security auditor is reviewing a GCP project and finds that a Compute Engine instance has the 'cloud-platform' scope and is running with the default service account. The auditor also notes that the instance has a startup script that downloads and runs a binary from a public URL. Which of the following is the MOST significant security risk?

   • AThe startup script is a potential vector for malware injection.
   • BThe instance is using the default service account, which is a shared account.
   • CThe instance's default service account has excessive permissions due to the 'cloud-platform' scope.
   • DThe instance is not protected by a firewall.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the primary objective of token theft in a cloud environment?

   • ATo perform denial-of-service attacks
   • BTo encrypt the victim's data
   • CTo obtain temporary credentials that grant access to cloud resources
   • DTo discover the victim's IP address
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   During a cloud security assessment, a tester finds that an AWS S3 bucket is configured with a bucket policy that allows 's3:PutObject' for any principal. What is the most critical risk associated with this misconfiguration?

   • AAn attacker can read sensitive data from the bucket.
   • BAn attacker can modify the bucket policy to gain full access.
   • CAn attacker can delete objects from the bucket.
   • DAn attacker can upload malicious content to the bucket, potentially leading to malware distribution.
   Reveal Solution Discussion Select an answer first