Cloud Security Assessment and Penetration Testing CSE Practice Questions (Page 10)

Questions 46–49

1. 46expert · hard

   A security team is conducting a penetration test on a hybrid cloud environment that includes an on-premises data center and an Azure subscription. The team has limited time and budget. The test scope includes the public-facing web application hosted in Azure and the internal database hosted on-premises. The team has discovered that the web application has a critical SQL injection vulnerability that could expose the on-premises database. What is the most efficient approach to test the database?

   • ASet up a VPN connection to the on-premises network and directly scan the database for vulnerabilities.
   • BUse Azure Bastion to access the on-premises database through the Azure subscription.
   • CUse the SQL injection vulnerability in the web application to access the on-premises database, because it is the only path to the database from the internet.
   • DSkip the database test because it is on-premises and not part of the cloud assessment.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A security firm is contracted to perform a penetration test on a client's Azure subscription. The client has provided written authorization and the subscription ID. The tester plans to use automated scanning tools that may generate high volumes of network traffic. What should the tester do before starting the scan?

   • AProceed with the scan because the client's authorization is sufficient.
   • BReview Azure's penetration testing policies and notify Microsoft if required.
   • CUse a VPN to hide the source of the scan traffic.
   • DDisable all Azure security features to avoid interference with the scan.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which tool is commonly used to scan cloud storage services for misconfigurations?

   • AMetasploit
   • BNmap
   • CWireshark
   • DScoutSuite
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A penetration tester is assessing a cloud environment that uses serverless functions (AWS Lambda) and API Gateway. The tester has identified that the API Gateway endpoint is publicly accessible and passes requests to a Lambda function. The tester wants to test for injection vulnerabilities in the Lambda function. Which technique is most appropriate?

   • AInvoke the Lambda function directly using the AWS CLI with malicious payloads.
   • BSend crafted HTTP requests to the API Gateway endpoint with malicious payloads.
   • CUse a network scanner to find open ports on the Lambda function.
   • DScan the Lambda function's source code for injection vulnerabilities.
   Reveal Solution Discussion Select an answer first