Cloud Penetration Testing CPENT Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which IAM misconfiguration allows a user to grant themselves additional permissions beyond those originally assigned?

   • ARole misassignment
   • BPrivilege escalation
   • CAuthentication bypass
   • DExcessive permissions
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is a recommended improvement for cloud monitoring to enhance detection of suspicious activities?

   • AImplementing real-time alerting on critical events
   • BReducing log retention to save costs
   • CStoring logs only locally on each instance
   • DDisabling verbose logging to reduce noise
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A penetration tester is testing an AWS Lambda function that processes user-supplied JSON data and stores results in an S3 bucket. The function uses the 'boto3' library to interact with S3. The tester discovers that the function's IAM role has 's3:PutObject' permission on a bucket that contains sensitive data. What is the most likely attack vector?

   • AInject malicious code into the JSON data to exploit a deserialization vulnerability in the Lambda runtime.
   • BUse the Lambda function's S3 write permission to overwrite objects in the sensitive bucket if the function allows user-controlled keys.
   • CTrigger the Lambda function with an event that causes it to read from the sensitive bucket and exfiltrate data.
   • DCraft a JSON payload that causes the Lambda function to write to an attacker-controlled S3 bucket.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   You are assessing a Kubernetes cluster on Amazon EKS. The cluster uses a node group with the 'AmazonEKSWorkerNodePolicy' and the nodes are in a private subnet. The cluster has a load balancer that exposes a web application to the internet. You discover that the web application pod has a service account that can list secrets in the cluster. What is the most significant risk?

   • AThe nodes are in a private subnet, which prevents them from reaching the internet, but this is not a security risk.
   • BAn attacker who compromises the web application can use the service account to list all secrets, potentially gaining access to database credentials and other sensitive data.
   • CThe load balancer is publicly accessible, which could allow attackers to directly access the Kubernetes API server.
   • DThe node group's IAM policy is too permissive, allowing the nodes to access other AWS services.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A large enterprise uses a multi-cloud strategy with AWS and Azure. They have a critical application that uses an AWS IAM role to access an Azure SQL database. The IAM role has a trust policy that allows the Azure AD application to assume it. During a penetration test, you discover that the Azure AD application has the 'Global Administrator' role. What is the most significant security risk?

   • AThe Azure AD application can be compromised, and an attacker could use its Global Administrator privileges to access the AWS IAM role and then the Azure SQL database.
   • BThe AWS IAM role is not properly scoped, allowing it to access resources beyond the Azure SQL database.
   • CThe trust policy is misconfigured because it allows an Azure AD application to assume an AWS role, which is not a supported configuration.
   • DThe Azure SQL database is publicly accessible, allowing direct attacks from the internet.
   Reveal Solution Discussion Select an answer first