Cloud Security Assessment and Penetration Testing CSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is planning a security assessment of its Azure environment, which includes a production web application, a development environment, and a third-party SaaS application used for HR. The compliance team requires that the assessment identify vulnerabilities in systems that store customer personal data. The company has a limited budget and wants to prioritize the most critical areas. What should the assessment scope include?

   • AThe production web application and the development environment, but exclude the SaaS application because it is vendor-managed.
   • BOnly the production web application, because it is the only system that stores customer personal data.
   • CAll three environments, because the assessment should cover every system that stores or processes customer personal data, regardless of hosting model.
   • DOnly the SaaS application, because it is the most likely to be misconfigured.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A penetration tester is assessing a serverless application on AWS that uses API Gateway, Lambda, and DynamoDB. The tester wants to test for authorization flaws in the API Gateway endpoints. The tester has been given the API keys for the application. What is the most effective technique to test for authorization flaws?

   • AUse the API keys to access the endpoints and then attempt to access other users' data by manipulating the request parameters.
   • BUse a network scanner to scan the API Gateway endpoints for open ports.
   • CAttempt to brute-force the API keys to gain access to the endpoints.
   • DUse a SQL injection tool to test the API Gateway endpoints for database vulnerabilities.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A penetration tester is performing reconnaissance on a target cloud environment. The tester wants to identify publicly accessible storage buckets and databases without triggering alerts. Which technique is most appropriate?

   • AUse search engines and cloud-specific enumeration tools to find exposed resources.
   • BSend crafted API requests to the cloud provider's endpoints to enumerate resources.
   • CPerform a full port scan of the target's IP ranges.
   • DUse social engineering to trick employees into revealing resource names.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During a cloud security assessment, a tester finds that an AWS IAM role has a policy that allows any user in the account to assume it. The role has administrative privileges. What is the most likely attack vector this misconfiguration enables?

   • APrivilege escalation by a low-privileged user assuming the role.
   • BData exfiltration from S3 buckets via the role's permissions.
   • CNetwork sniffing of traffic between EC2 instances.
   • DDenial of service by revoking the role's permissions.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security assessment of a cloud environment identified a misconfigured Azure Blob Storage container that allows public read access to a backup file containing hashed user passwords. The assessment team also found that the container's diagnostic logs are not enabled. What is the most appropriate remediation recommendation to include in the report?

   • AEnable diagnostic logging and then remove public access, but do not rotate passwords because the file is a backup.
   • BDelete the backup file and recreate it with a new name, but keep the container public for internal access.
   • CRemove public access from the container, rotate the affected user passwords, and enable diagnostic logging for the storage account.
   • DOnly remove public access from the container, because the passwords are hashed and cannot be reversed.
   Reveal Solution Discussion Select an answer first