Cloud Penetration Testing CPENT Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   During a cloud penetration test, you have compromised a web server in a public subnet of an AWS VPC. You want to move laterally to a database server in a private subnet. The security group for the database server allows inbound traffic only from the web server's security group on port 3306. What is the most likely way to proceed?

   • AScan the private subnet for other open ports on the database server.
   • BUse the web server as a jump host to connect to the database server on port 3306.
   • CModify the database server's security group to allow your IP address.
   • DDirectly connect to the database server from your attacker machine because the security group only restricts by IP, not by instance.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   During cloud reconnaissance, which technique can be used to discover Azure storage accounts that are publicly accessible?

   • AUsing Wireshark to capture network traffic to Azure
   • BBrute-forcing storage account names against a known DNS pattern
   • CUsing Shodan to search for open ports on storage accounts
   • DQuerying the Azure REST API for storage account names
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which of the following is a primary method to test for public access to an Azure Blob Storage container?

   • AUsing SQL injection on the storage account
   • BChecking the container's firewall rules
   • CScanning the container's IP address with nmap
   • DAttempting to access the container's URL without authentication
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which cloud deployment model is characterized by infrastructure that is provisioned for exclusive use by a single organization, but may be managed by the organization or a third party and may exist on or off premises?

   • AHybrid cloud
   • BCommunity cloud
   • CPublic cloud
   • DPrivate cloud
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A security tester is evaluating a Google Cloud Storage bucket that is supposed to contain internal reports. The tester attempts to access the bucket without authentication and receives an 'AccessDenied' error. However, the tester knows that the bucket name is 'acme-internal-reports'. What is the next best step to test for misconfiguration?

   • AEnumerate other buckets with similar names to find one that is public.
   • BCheck the bucket's IAM policy and bucket ACLs for overly permissive grants to 'allUsers' or 'allAuthenticatedUsers'.
   • CAttempt to list objects using the 'objects.list' API with the bucket name.
   • DTry common IAM roles like 'roles/storage.objectViewer' on the bucket.
   Reveal Solution Discussion Select an answer first