Cloud Security Assessment and Penetration Testing CSE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is a common cloud-specific attack vector?

   • ABuffer overflow
   • BMisconfigured storage buckets
   • CSQL injection
   • DCross-site scripting
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security consultant is hired to perform a penetration test against a customer's AWS environment. The customer provides a signed authorization letter and the AWS account ID, but the consultant discovers the target includes an S3 bucket that is owned by a different AWS account. The consultant plans to test the bucket for misconfigurations. What is the most appropriate first step?

   • AProceed with testing the bucket because the authorization letter covers the customer's environment.
   • BContact the bucket owner to obtain explicit written authorization before testing.
   • CUse the customer's AWS account credentials to assume a role and test the bucket through the customer's account.
   • DSkip the bucket and test only resources within the customer's own AWS account.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   During a cloud penetration test, a tester discovers that an Azure Storage account has a container with public blob access enabled. The tester wants to confirm whether the container contains sensitive data. Which technique is most appropriate to validate the exposure without causing disruption?

   • AUpload a test file to the container to verify write access.
   • BUse Azure CLI to list the storage account keys and access the container.
   • CAttempt to list the container's blobs using the anonymous access URL.
   • DDelete a sample blob to confirm the container is publicly accessible.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A penetration testing firm is contracted to assess a client's hybrid cloud environment that includes on-premises servers and AWS resources. The client's legal team requires that the test be conducted without violating any data residency laws. The tester plans to use a cloud-based scanning service that stores scan results in a third-country data center. What is the most appropriate action?

   • ASelect a scanning service that stores data in a region that complies with the client's data residency requirements.
   • BRun the scan from the tester's local machine and store results on-premises.
   • CUse the cloud-based scanning service but ensure that scan results are encrypted before storage.
   • DProceed with the scan and anonymize the results before storing them.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which statement best describes the primary purpose of a cloud security assessment?

   • ATo replace the need for continuous monitoring and incident response
   • BTo evaluate the effectiveness of security controls and identify gaps against defined requirements
   • CTo guarantee that no security vulnerabilities exist in the cloud environment
   • DTo ensure the cloud provider is responsible for all security controls
   Reveal Solution Discussion Select an answer first