Cloud Penetration Testing CPENT Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   After a security incident in a Google Cloud Platform (GCP) project, you need to determine if any unauthorized actions were performed by a compromised service account. You have access to Cloud Logging. What is the most effective way to identify the actions taken by this specific service account?

   • ACheck the audit logs for the specific resources the service account might have accessed.
   • BQuery Cloud Logging for all log entries where 'protoPayload.authenticationInfo.principalEmail' equals the service account's email address.
   • CUse Cloud Monitoring to view metrics for the service account's API usage.
   • DReview the IAM policy of the project to see what permissions the service account has.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is a key gap in cloud logging that can hinder incident response?

   • ALogs do not capture user activity in the management plane
   • BLogs are stored in a centralized location
   • CLogs are retained for a sufficient period
   • DLogs are encrypted at rest
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company uses AWS Lambda functions to process user-uploaded images. The function takes an image URL from an API request, downloads it, and stores it in an S3 bucket. During a penetration test, you find that the function does not validate the URL and uses the 'requests' library to fetch it. What is the most likely vulnerability an attacker could exploit?

   • ADenial of Service (DoS) by providing a URL to a very large file, exhausting the Lambda function's memory.
   • BSQL injection by embedding malicious SQL in the image URL.
   • CServer-Side Request Forgery (SSRF) by providing a URL that points to internal AWS metadata endpoints (e.g., 169.254.169.254) to steal IAM credentials.
   • DCross-Site Scripting (XSS) by uploading an image with malicious JavaScript in its metadata.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   You are conducting a penetration test on a GCP environment. You find a Compute Engine VM with a public IP and a firewall rule allowing TCP port 22 (SSH) from the entire internet (0.0.0.0/0). The VM has a service account with 'roles/compute.instanceAdmin' at the project level. What is the most critical risk you should report?

   • AThe firewall rule is misconfigured because it allows SSH from any source, which is a violation of GCP best practices.
   • BThe VM's service account can be used to access the GCP metadata server and steal the project's API keys.
   • CThe VM is vulnerable to SSH brute-force attacks, which could lead to unauthorized access.
   • DAn attacker can SSH into the VM and use the service account's permissions to create or delete instances across the project.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following is a common injection flaw in serverless functions?

   • ASQL injection
   • BBuffer overflow
   • CFormat string attack
   • DRace condition
   Reveal Solution Discussion Select an answer first