Cloud Security Assessment and Penetration Testing CSE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A multinational company operates in the EU and stores personal data of EU citizens in an AWS environment. The company wants to conduct a penetration test that includes testing the security of its data storage and processing. The legal team is concerned about GDPR compliance and the shared responsibility model. The company's security team plans to use a third-party penetration testing firm. What is the most important consideration for the company to address before the test?

   • AObtain approval from AWS before the test, because AWS is a data processor and must consent to the testing.
   • BHave the penetration testing firm sign a non-disclosure agreement (NDA) to protect the company's data.
   • CEnsure the penetration testing firm signs a data processing agreement (DPA) and that the test is conducted in a way that does not violate GDPR data transfer rules.
   • DEnsure the test is conducted only in the EU region to avoid any GDPR data transfer issues.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary legal requirement before conducting a penetration test against a cloud environment?

   • APurchasing a penetration testing license
   • BNotifying local law enforcement
   • CObtaining written authorization from the cloud customer and the cloud provider
   • DRegistering with a security certification body
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security consultant is hired to perform a penetration test against a customer's AWS environment. The customer has provided a signed authorization letter and a list of in-scope account IDs, but the consultant discovers that the customer's AWS account is part of an AWS Organizations organization with several other member accounts. The consultant wants to run a network scan from a temporary EC2 instance in the customer's VPC. What is the most appropriate first step before starting the scan?

   • AAsk the customer to confirm that the AWS Organizations member accounts are in scope and obtain written authorization for each account.
   • BContact AWS Support to request permission to scan the member accounts before proceeding.
   • CUse the management account's credentials to run the scan from the management account's VPC, avoiding the need to touch member accounts.
   • DProceed with the scan because the signed authorization letter covers the entire AWS Organizations organization.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During a penetration test of a cloud environment, a tester discovers that an application's API endpoint allows unauthenticated access to a function that returns sensitive user data. The tester also notices that the API's rate limiting is not enabled. What is the most likely cloud-specific attack vector being exploited?

   • AMisconfigured storage, where the API is backed by an S3 bucket that is publicly readable.
   • BNetwork misconfiguration, where the API is exposed on a public subnet without a firewall.
   • CInsecure API design, where authentication and rate limiting are missing, allowing unauthorized access and potential data exfiltration.
   • DIdentity and access management (IAM) flaw, where the API's service account has overly broad permissions.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a key component of a clear penetration test report?

   • AA prioritized list of vulnerabilities with remediation recommendations
   • BA summary of the cloud provider's security posture
   • CThe personal opinions of the tester
   • DA list of all tools used during the test
   Reveal Solution Discussion Select an answer first