Cloud Penetration Testing CPENT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A healthcare organization uses AWS S3 to store patient records. They are required to comply with HIPAA. During a review, you find that the S3 bucket has server-side encryption enabled with AWS-managed keys (SSE-S3). What is the most important compliance gap you should identify?

   • AThe bucket does not have versioning enabled, which is required for data retention and audit trails.
   • BThe bucket policy may allow public access, which would violate HIPAA's requirement to protect electronic protected health information (ePHI).
   • CSSE-S3 does not provide the required encryption strength for HIPAA compliance.
   • DSSE-S3 does not allow for key rotation, which is required by HIPAA.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During the reconnaissance phase of a cloud penetration test, you are tasked with discovering any publicly exposed Azure Blob storage containers that belong to the target organization. Which technique is most effective for this purpose?

   • AUse a tool like MicroBurst or a custom script to enumerate storage account names and check for anonymous access.
   • BUse the Azure CLI to list all storage accounts in the target's subscription.
   • CPerform a DNS brute-force of common storage account names and then attempt to access them via the Azure portal.
   • DSearch for storage account names in public code repositories and paste sites.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which cloud storage service is commonly associated with the term 'bucket'?

   • AAzure Blob Storage
   • BAWS EBS
   • CAWS S3
   • DGoogle Cloud Storage
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration tester is engaged to assess a healthcare organization's hybrid cloud environment. The organization uses an IaaS provider for production VMs and a SaaS application for patient scheduling. The tester has been granted permission to test the IaaS environment but not the SaaS application. During reconnaissance, the tester discovers that the SaaS application stores patient data in a cloud storage bucket that appears to be publicly accessible. What is the most appropriate action for the tester to take?

   • AIgnore the bucket because it is not part of the IaaS environment and the client did not ask about it.
   • BProceed to test the bucket because it contains patient data, which is a critical finding regardless of scope.
   • CTest the bucket for public access and document the findings as part of the IaaS assessment because the bucket is in the cloud.
   • DReport the potential misconfiguration to the client as an out-of-scope observation and recommend they contact the SaaS provider.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company uses Azure Functions with a Consumption plan to process messages from a queue. The function triggers on new messages and writes results to a database. During a penetration test, you find that the function uses a connection string stored in the application settings, and the function app has 'Managed Identity' disabled. What is the most significant security weakness?

   • AThe connection string is stored in plain text in application settings, which can be read by anyone with access to the function app's configuration.
   • BThe Consumption plan has a timeout limit that could cause the function to fail for long-running tasks.
   • CThe function is vulnerable to SQL injection because it processes messages from a queue.
   • DThe function app does not have a virtual network integration, making it accessible from the internet.
   Reveal Solution Discussion Select an answer first