Cloud CLI and Application Mapping GCPN Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A penetration tester is mapping a multi-tier application on AWS. The application consists of an ALB, EC2 instances in a private subnet, and an RDS database. The tester has IAM credentials with read-only access to EC2, ELBv2, and RDS. The tester needs to create a comprehensive map of the application, including the ALB's target group, the EC2 instances, and the RDS database that the instances connect to. Which sequence of AWS CLI commands would be most efficient?

   • A`aws rds describe-db-instances` → `aws ec2 describe-instances` → `aws elbv2 describe-target-groups`
   • B`aws elbv2 describe-target-groups` → `aws elbv2 describe-target-health` → `aws ec2 describe-instances` → `aws rds describe-db-instances`
   • C`aws ec2 describe-instances` → `aws rds describe-db-instances` → `aws elbv2 describe-target-groups`
   • D`aws elbv2 describe-load-balancers` → `aws elbv2 describe-listeners` → `aws ec2 describe-instances`
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which environment variable is commonly used to specify the AWS access key ID for the AWS CLI?

   • AAWS_ACCESS_KEY_ID
   • BAWS_SECRET_ACCESS_KEY
   • CAWS_PROFILE
   • DAWS_SESSION_TOKEN
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How can cloud CLI enumeration enhance application mapping?

   • ABy providing the application's source code
   • BBy providing details about cloud resources that the application uses
   • CBy replacing the need for manual application testing
   • DBy automatically exploiting vulnerabilities in the application
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A penetration tester is fingerprinting a web application that appears to be a custom-built Node.js application. The tester wants to identify the exact framework and version, as well as any API endpoints that might be exposed. Which tool or technique would be most effective for this task?

   • AUse `nikto` to scan for vulnerabilities and identify the framework, then use `burp suite` to manually explore API endpoints.
   • BUse `curl -I` to fetch the HTTP headers and look for the `X-Powered-By` header, then use `dirb` to find API endpoints.
   • CUse `nmap` with the `--script http-headers` to identify the framework and version, then use `gobuster` to enumerate API endpoints.
   • DUse `whatweb` to identify the framework and version, then manually inspect the JavaScript files for API endpoints.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A penetration tester is assessing a web application that is behind a Content Delivery Network (CDN). The tester suspects the application is a Java Spring Boot application. The tester needs to confirm the framework and version, and also discover any API endpoints that are not cached by the CDN. Which approach would be most effective?

   • AUse `nmap` to scan the origin server directly, bypassing the CDN, and then use `nikto` to identify the framework.
   • BUse `whatweb` to fingerprint the application, then use `curl` to fetch the `/actuator` endpoint to reveal framework details and API endpoints.
   • CUse `burp suite` to intercept traffic and manually analyze the HTTP headers and API calls.
   • DUse `gobuster` to brute-force directories on the CDN-hosted domain, looking for API endpoints.
   Reveal Solution Discussion Select an answer first