Cloud Security Assessment and Penetration Testing CSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is a key limitation when performing network-based penetration testing in a cloud environment?

   • ACloud environments do not use IP addresses
   • BNetwork-based testing is always ineffective in the cloud
   • CThe cloud provider restricts certain types of scans and tests
   • DAll cloud traffic is encrypted and cannot be analyzed
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A penetration testing firm is hired to test a client's cloud environment that is subject to the General Data Protection Regulation (GDPR). The test will involve processing personal data of EU citizens. The client is based in the EU, but the testing firm's servers are located in the United States. What is the most appropriate way to handle this situation?

   • AHave the client's own employees conduct the test to avoid data transfer issues.
   • BAnonymize all personal data before the test to avoid GDPR requirements.
   • CProceed with the test using US-based servers because the client is in the EU.
   • DEnsure that the testing firm signs a data processing agreement with the client and uses EU-based servers for the test.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company wants to conduct a penetration test on its AWS environment, which includes EC2 instances, an RDS database, and an S3 bucket. The company's legal team is concerned about compliance with AWS's penetration testing policy. What should the company do before starting the test?

   • AProceed with the test without any notification because the company owns the resources.
   • BHire a third-party penetration testing firm to avoid the need for AWS approval.
   • CNotify AWS Support via email about the planned test, but no formal approval is needed.
   • DReview AWS's penetration testing policy and submit a request for approval if the test involves services that require prior authorization.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary purpose of the reporting phase in a cloud penetration test?

   • ATo exploit vulnerabilities to demonstrate impact
   • BTo document findings, evidence, and recommended remediation steps
   • CTo obtain written authorization from the cloud provider
   • DTo gather information about the target environment
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team is conducting a penetration test on a cloud environment that uses Azure Active Directory (Azure AD) for authentication. The team discovers that an application's service principal has 'Global Administrator' role, and the application's client secret is stored in a source code repository. The team also finds that the application's API is publicly accessible. What is the most critical attack path an attacker could exploit?

   • AAttempt to access the source code repository to find other secrets, but the repository is private.
   • BExploit the public API to access the application's data, but the API does not have any known vulnerabilities.
   • CUse the exposed client secret to authenticate as the service principal and gain Global Administrator privileges.
   • DUse the public API to enumerate users and then attempt to brute-force their passwords.
   Reveal Solution Discussion Select an answer first