Cloud Security Assessment and Penetration Testing CSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A penetration test report identifies a critical vulnerability in a cloud application that allows unauthorized access to customer data. The client wants to know the business impact and the urgency of remediation. What is the most appropriate way to present this information in the report?

   • AInclude a risk rating based on the likelihood and impact of exploitation.
   • BProvide only the technical details of the vulnerability and let the client decide.
   • CRecommend immediate remediation without explaining the impact.
   • DList all vulnerabilities found, regardless of severity, in alphabetical order.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A penetration tester is assessing a Google Cloud Platform (GCP) project that hosts a Kubernetes cluster. The tester wants to test for container escape vulnerabilities and misconfigurations in the cluster's RBAC policies. The tester has been granted the 'Kubernetes Engine Admin' role in the project. Which of the following actions is most appropriate for the tester to perform?

   • ARun a vulnerability scan against the GCP control plane APIs to identify weaknesses in GCP's infrastructure.
   • BDisable the cluster's audit logging to avoid detection during the test.
   • CUse kubectl to inspect the cluster's RBAC policies and attempt to exploit any misconfigurations, such as overly permissive roles.
   • DAttempt to access the underlying GCP host nodes to test for hypervisor vulnerabilities.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A penetration tester is assessing a serverless application on AWS Lambda. The tester wants to test for vulnerabilities in the Lambda function's code and its integration with other AWS services. Which of the following tools or techniques is most appropriate for this assessment?

   • AAttempt to access the underlying EC2 instance that hosts the Lambda function.
   • BUse a password cracking tool to test the Lambda function's IAM role credentials.
   • CRun a network vulnerability scanner against the Lambda function's public endpoint.
   • DUse a static application security testing (SAST) tool to analyze the Lambda function's source code for vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is planning a penetration test on its GCP environment, which includes a production Kubernetes cluster and a Cloud SQL database. The company's compliance team requires that the test not disrupt production services. The security team wants to test for container escape vulnerabilities and SQL injection in the database. What is the most appropriate testing strategy?

   • ATest the production cluster and database directly, because the test is authorized and the team has experience.
   • BUse a vulnerability scanner on the production cluster and database, but do not attempt any exploitation.
   • CUse a separate GCP project for testing container escape and SQL injection, and only test the production environment with non-disruptive techniques.
   • DOnly test the Cloud SQL database, because container escape testing is too risky for production.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of recommending remediation strategies in a penetration test report?

   • ATo guide the organization in fixing identified vulnerabilities
   • BTo replace the need for future testing
   • CTo justify the cost of the penetration test
   • DTo assign blame for security issues
   Reveal Solution Discussion Select an answer first