Cloud Hacking Methodology CEH Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An attacker has compromised an EC2 instance in a private subnet within a VPC. The instance has an IAM role attached that only allows 's3:GetObject' on a specific bucket. The attacker wants to move laterally to an RDS database in the same VPC. Which of the following is the MOST viable lateral movement technique?

   • ACreate a new IAM user with RDS access from the compromised instance.
   • BUse the instance's metadata service to retrieve temporary credentials for the RDS service.
   • CUse the IAM role to call the RDS DescribeDBInstances API to get the database endpoint and credentials.
   • DScan the VPC's CIDR range for open ports on the RDS instance and attempt to connect using default credentials.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Why do attackers modify IAM policies to establish persistence in a cloud environment?

   • ATo encrypt the victim's data
   • BTo disable security monitoring
   • CTo delete the victim's resources
   • DTo grant themselves ongoing access to cloud resources
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is a common result of exploiting an overly permissive IAM policy in a cloud environment?

   • AEncrypting all data in the cloud
   • BDeleting the cloud provider's infrastructure
   • CChanging the cloud provider's billing settings
   • DGaining unauthorized access to cloud resources
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A penetration tester is starting a cloud assessment for a client that uses a multi-cloud environment (AWS and Azure). The tester has been given no credentials and must begin from an external perspective. Which of the following is the MOST appropriate first step in the cloud hacking methodology?

   • AAttempt to brute-force the client's cloud console login pages.
   • BEnumerate the client's public cloud assets by searching for domain names, IP ranges, and known bucket names.
   • CCheck the client's public GitHub repositories for leaked secrets and API keys.
   • DScan the client's public IP ranges for open ports and services.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which cloud persistence mechanism involves creating a new user account with administrative privileges?

   • ALog tampering
   • BModifying IAM policies
   • CDeploying malicious resources
   • DBackdoor account creation
   Reveal Solution Discussion Select an answer first