Cloud Security Assessment and Penetration Testing CSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is an example of an identity and access management (IAM) flaw that is a common cloud attack vector?

   • AWeak encryption algorithms
   • BUnpatched operating system
   • COverly permissive IAM policies
   • DOpen database ports
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is planning a cloud security assessment to comply with a new industry regulation. The regulation requires that the assessment be independent and that findings be reported to the board. The company has an internal security team that is knowledgeable about the cloud environment. What is the most appropriate approach?

   • AHave the internal security team conduct the assessment and report to the board.
   • BConduct a self-assessment and have the board review the results.
   • CUse automated tools to conduct the assessment and generate the report automatically.
   • DHire an external third-party assessor to conduct the assessment.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A penetration test report for a cloud environment includes a finding that an Azure VM has a public IP address and is running an outdated version of a web server with known vulnerabilities. The report also notes that the VM's network security group (NSG) allows inbound traffic from any source on port 443. The customer wants to remediate the issue but has limited budget. What is the most cost-effective remediation to prioritize?

   • AMove the VM to a different subnet with stricter NSG rules.
   • BChange the NSG to only allow inbound traffic from specific IP addresses.
   • CUpdate the web server to the latest version to patch the known vulnerabilities.
   • DRemove the public IP address from the VM and use Azure Bastion for access.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which phase of a standard penetration testing methodology involves actively probing cloud services to identify open ports and services?

   • AReporting
   • BScanning
   • CReconnaissance
   • DExploitation
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A penetration tester is assessing a Google Cloud Platform (GCP) project. The tester needs to identify misconfigured firewall rules and overly permissive IAM roles across the project. Which approach is most effective for this assessment?

   • AUse the GCP Console to manually check each resource's settings.
   • BRun a network port scan from the tester's local machine to identify open ports.
   • CUse gcloud commands to enumerate firewall rules and IAM policies for each resource.
   • DDeploy a VM inside the project and run vulnerability scans from within the network.
   Reveal Solution Discussion Select an answer first