Examers.io
ExamsOrganizationsHow it worksPricingHelp & FAQ
Sign inStart free
GIAC (SANS)

GIAC Cloud Penetration Tester

GCPN

The GIAC Cloud Penetration Tester (GCPN) certification validates your ability to bridge cloud technology fluency with hands-on penetration testing skills. Designed for offensive and defensive security practitioners, it proves you can assess and test the security of systems, networks, architecture, and cloud technologies across AWS and Azure. Earning GCPN demonstrates readiness to simulate real-world attacks and defend modern cloud enterprises.

Practice Free Questions

466 practice questions · Updated 2026-07-30

6Domains
12Objectives
92Concepts
466Questions

GCPN Curriculum

Every domain, objective, and concept the GCPN exam measures.

Cloud Penetration Testing Fundamentals

1 concepts · 30 questions
  1. Cloud Penetration Testing Fundamentals

Red Team Penetration Testing of Cloud Environments

11 concepts · 46 questions
  1. Cloud Red Team Fundamentals
  2. Cloud Threat Modeling
  3. Cloud Reconnaissance Techniques
  4. Cloud Service Enumeration
  5. Cloud Authentication and Authorization Attacks
  6. Cloud Storage and Data Exfiltration
  7. Cloud Compute and Container Exploitation
  8. Cloud Network and Traffic Manipulation
  9. Cloud Logging and Detection Evasion
  10. Cloud Post-Exploitation and Persistence
  11. Cloud Red Team Reporting and Remediation

Discovering Cloud Services and Data

7 concepts · 40 questions
  1. Cloud Service Enumeration
  2. Cloud Storage Bucket Discovery
  3. Cloud Metadata Service Exploitation
  4. Cloud API Reconnaissance
  5. Cloud Service Fingerprinting
  6. Public Data Mining for Cloud Assets
  7. Cloud Service Misconfiguration Detection

Cloud CLI and Application Mapping

9 concepts · 38 questions
  1. Cloud CLI Fundamentals
  2. CLI Authentication and Configuration
  3. Resource Enumeration via CLI
  4. CLI-Based Service Discovery
  5. Application Mapping Fundamentals
  6. Web Application Fingerprinting
  7. API Discovery and Analysis
  8. Cloud Metadata and Configuration Analysis
  9. Integration of CLI and Application Mapping

AWS Authentication and Cloud Services

6 concepts · 30 questions
  1. AWS Authentication Mechanisms
  2. AWS Cloud Services Overview
  3. IAM Policies and Permissions
  4. AWS Credential Management
  5. Authentication Attack Vectors
  6. AWS Service Interaction

Microsoft Azure Cloud Services and Attacks

10 concepts · 42 questions
  1. Azure Resource Manager (ARM) and Management Plane
  2. Azure Virtual Machines (VMs) and Compute Services
  3. Azure Storage Services
  4. Azure Networking Components
  5. Azure Active Directory (Azure AD) and Identity
  6. Azure Key Vault and Secrets Management
  7. Azure App Services and Serverless
  8. Azure Kubernetes Service (AKS)
  9. Azure DevOps and CI/CD Pipelines
  10. Azure Monitoring and Logging Evasion

Azure Functions and Windows Containers

7 concepts · 37 questions
  1. Azure Functions Attack Surface
  2. Serverless Function Vulnerabilities
  3. Exploiting Azure Functions
  4. Windows Container Security
  5. Container Escape Techniques
  6. Attacking Container Orchestration
  7. Defensive Measures

Containers and Kubernetes Structure

6 concepts · 49 questions
  1. Container Architecture
  2. Kubernetes Architecture
  3. Container Orchestration Fundamentals
  4. Kubernetes Objects and Resources
  5. Container Networking Basics
  6. Storage in Containers and Kubernetes

Cloud Native Applications and CI/CD Pipelines

9 concepts · 54 questions
  1. Cloud Native Application Architecture
  2. CI/CD Pipeline Fundamentals
  3. CI/CD Security Risks
  4. Secure Pipeline Configuration
  5. Secrets Management in CI/CD
  6. Supply Chain Security
  7. Infrastructure as Code (IaC) Security
  8. Container Security in Pipelines
  9. CI/CD Compliance and Auditing

Web Application Attacks

10 concepts · 29 questions
  1. Web Application Attack Fundamentals
  2. Injection Attacks
  3. Cross-Site Scripting (XSS)
  4. Cross-Site Request Forgery (CSRF)
  5. Authentication and Session Attacks
  6. File Upload and Path Traversal
  7. XML and SSRF Attacks
  8. Web Application Firewall Evasion
  9. Exploitation Tools and Frameworks
  10. Mitigation and Remediation

Password Attacks on Cloud Environments

8 concepts · 48 questions
  1. Cloud Password Attack Vectors
  2. Credential Harvesting Techniques
  3. Password Spraying in Cloud
  4. Brute Force Attacks on Cloud Services
  5. Credential Stuffing and Reuse
  6. Cloud Identity Provider Attacks
  7. Evading Detection in Password Attacks
  8. Mitigation and Defense Strategies

Redirection and Attack Obfuscation

8 concepts · 23 questions
  1. HTTP Redirection Techniques
  2. Redirection for Credential Harvesting
  3. Obfuscation of Redirection Payloads
  4. Detection and Evasion of Redirection
  5. Attack Obfuscation Fundamentals
  6. Obfuscation Techniques for Credential Attacks
  7. Evasion of Security Controls
  8. Integration of Redirection and Obfuscation
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Practice Free Questions

Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for GCPN, so none is invented.