You are testing a REST API deployed on Azure API Management. The API uses OAuth 2.0 with client credentials grant. You notice that the API returns detailed error messages, including stack traces, when an invalid token is provided. What is the most significant security issue?

The API is vulnerable to brute-force attacks because it does not implement rate limiting.

The API is vulnerable to SQL injection because the error messages reveal database schema.

Information disclosure that could reveal internal implementation details, aiding an attacker in crafting further attacks.

The OAuth 2.0 client credentials grant is inherently insecure and should not be used.

A cloud security team is reviewing their logging configuration. They have enabled CloudTrail in AWS, but they notice that S3 data events are not being logged. They are concerned about missing visibility into unauthorized access to sensitive objects. What is the best recommendation?

Enable CloudTrail data events for the S3 buckets that contain sensitive data.

Enable AWS Config to record S3 bucket configurations.

Enable VPC Flow Logs for the S3 buckets.

Enable CloudTrail management events for the S3 buckets.

EC-CouncilCertified Penetration Testing Professional

Domain 7Objective 3

Cloud Penetration Testing CPENT Practice Questions (Page 8)

Part of the Specialized Testing and Reporting domain, which makes up ~23% of our current practice bank.

51questions here

11free pages

12concepts

12 Concepts in This Objective

Cloud Architecture Fundamentals
Cloud Threat Modeling
Cloud Service Provider Reconnaissance
Identity and Access Management (IAM) Testing
Cloud Storage Security Testing
Virtual Network and Compute Testing
Container and Orchestration Security
Serverless Function Testing
Cloud API Security Testing
Cloud Logging and Monitoring Assessment
Cloud Compliance and Governance Review
Cloud Penetration Testing Methodology

Questions 36–40

36application · medium
You are testing a REST API deployed on Azure API Management. The API uses OAuth 2.0 with client credentials grant. You notice that the API returns detailed error messages, including stack traces, when an invalid token is provided. What is the most significant security issue?
Select an answer first
37application · medium
A cloud security team is reviewing their logging configuration. They have enabled CloudTrail in AWS, but they notice that S3 data events are not being logged. They are concerned about missing visibility into unauthorized access to sensitive objects. What is the best recommendation?
Select an answer first
38foundation · easy
Which component of a container orchestration platform is responsible for managing the desired state of the cluster?
Select an answer first
39foundation · easy
Which of the following is a common API-level attack that targets the authentication mechanism?
Select an answer first
40foundation · easy
Which phase of a cloud penetration test involves obtaining permission from the cloud provider?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.

Cloud Penetration Testing CPENT Practice Questions (Page 8)

Questions 36–40

You are testing a REST API deployed on Azure API Management. The API uses OAuth 2.0 with client credentials grant. You notice that the API returns detailed error messages, including stack traces, when an invalid token is provided. What is the most significant security issue?

A cloud security team is reviewing their logging configuration. They have enabled CloudTrail in AWS, but they notice that S3 data events are not being logged. They are concerned about missing visibility into unauthorized access to sensitive objects. What is the best recommendation?

Which component of a container orchestration platform is responsible for managing the desired state of the cluster?

Which of the following is a common API-level attack that targets the authentication mechanism?

Which phase of a cloud penetration test involves obtaining permission from the cloud provider?

Keep studying — Specialized Testing and Reporting