AWS Authentication and Cloud Services GCPN Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A penetration tester is assessing a client's AWS environment. The client has a production account and a development account. The production account has an IAM role that allows 'sts:AssumeRole' from the development account. The tester discovers that the development account has a role with a trust policy that allows 'sts:AssumeRole' from any AWS account. The tester wants to demonstrate a privilege escalation path to the production account. Which approach would BEST demonstrate this?

   • AModify the production role's trust policy to allow the external account.
   • BUse the 'aws iam simulate-principal-policy' command to check if the production role can be assumed.
   • CAssume the development account role from an external account, then assume the production account role using the development role's credentials.
   • DDirectly assume the production account role from an external account without going through the development account.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration tester discovers that an AWS account has an IAM role with a trust policy that allows 'sts:AssumeRole' from any principal in the 'arn:aws:iam::*:root' pattern. The tester wants to demonstrate the risk to the client. Which action would BEST prove the vulnerability without modifying the role's permissions?

   • ACreate a new IAM user in the tester's own AWS account and attempt to assume the target role using the AWS CLI.
   • BUse the 'aws iam get-role' command to retrieve the trust policy and present it as evidence in the report.
   • CModify the trust policy to restrict it to the client's own account, then test the assumption from the client's account.
   • DAttempt to access the AWS Management Console using the role's ARN without any credentials.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which attack vector involves an attacker obtaining AWS credentials by tricking a user into entering them on a fake AWS sign-in page?

   • ABrute-force attack on an IAM user password
   • BMisconfigured trust policy
   • CCredential theft via phishing
   • DSession hijacking
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security consultant is reviewing an IAM policy attached to a role used by an EC2 instance. The policy grants 'ec2:RunInstances' and 'iam:PassRole' on all resources. The consultant wants to explain the risk to the client. What is the MOST significant risk of this policy combination?

   • AThe instance can be stopped or terminated by an attacker, causing a denial of service.
   • BThe instance can modify VPC settings, such as deleting subnets or security groups.
   • CThe role can be used to access the AWS Management Console without MFA.
   • DAn attacker who compromises the instance can launch new EC2 instances with any IAM role, potentially gaining elevated permissions.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which component is required for an application to authenticate to AWS APIs when using an IAM user's long-term access keys?

   • APrivate key and certificate
   • BPassword and MFA code
   • CAccess key ID and secret access key
   • DSession token and access key ID
   Reveal Solution Discussion Select an answer first