Cloud Security Assessment and Penetration Testing CSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   After completing a cloud security assessment, a consultant identified a critical vulnerability in a customer's Azure storage account that allows public access to sensitive data. The consultant also found that the customer's security team is not aware of the vulnerability. What is the most important element to include in the final report?

   • AA summary of the consultant's qualifications and the methodology used.
   • BA list of all tools used during the assessment, including their versions and configurations.
   • CA copy of the signed authorization letter to prove the test was authorized.
   • DA detailed description of the vulnerability, its potential impact, and a step-by-step remediation plan.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration tester is performing reconnaissance on a target AWS environment. The tester has been given the account ID and the public IP range of the VPC. The tester wants to identify the services running on the public IPs and any misconfigured security groups. Which of the following techniques is most appropriate for this phase?

   • AUse a DNS enumeration tool to find subdomains pointing to the VPC's public IPs.
   • BAttempt to brute-force the root account password to gain access to the AWS console.
   • CPerform a port scan of the public IP range using a tool like Nmap, then correlate the results with known AWS service ports.
   • DUse the AWS CLI to list all security groups in the account and review their rules.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A penetration test report for a cloud environment includes a finding that a Kubernetes cluster has a misconfigured RBAC policy that allows any authenticated user to create pods. The report also notes that the cluster's audit logging is not enabled. The customer wants to remediate the issue but has limited resources. What is the most critical remediation step to prioritize?

   • AEnable audit logging to detect future unauthorized pod creation attempts.
   • BFix the RBAC policy to restrict pod creation to authorized users only.
   • CRestrict access to the Kubernetes API server by using a private endpoint.
   • DUpgrade the Kubernetes cluster to the latest version to patch any known vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A cloud security tester is assessing a Google Cloud Platform (GCP) project that uses Cloud Functions. The tester wants to identify if any Cloud Functions have overly permissive IAM policies that allow unauthenticated invocation. Which tool or technique is most appropriate?

   • ARun a network scan of the Cloud Functions' endpoints.
   • BUse the GCP Console to manually check each function's settings.
   • CUse gcloud functions get-iam-policy for each function.
   • DDeploy a test Cloud Function and check its IAM policy.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During a penetration test, a tester discovers that an AWS IAM role has a policy that allows 's3:PutObject' on a critical bucket, but the role is assumed by an EC2 instance that is publicly accessible. The tester also finds that the instance has a known vulnerability that allows remote code execution. What is the most likely attack path an attacker could use?

   • AUse the instance's metadata service to retrieve the IAM role's temporary credentials, then access the S3 bucket.
   • BExploit the S3 bucket's public access to upload malicious objects directly.
   • CDirectly access the S3 bucket using the instance's public IP address.
   • DExploit the remote code execution vulnerability on the EC2 instance, then use the instance's IAM role to upload malicious objects to the S3 bucket.
   Reveal Solution Discussion Select an answer first