Cloud CLI and Application Mapping GCPN Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which HTTP method is typically used to retrieve information from an API endpoint?

   • ADELETE
   • BPUT
   • CPOST
   • DGET
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A cloud penetration tester is assessing an Azure subscription and needs to discover which services are available in a specific region (e.g., East US) to understand the attack surface. The tester has authenticated with the Azure CLI. Which command should the tester run to list the available services in that region?

   • A`az account list-locations --query "[?name=='eastus'].displayName"`
   • B`az provider list --location eastus`
   • C`az provider list --query "[?location=='eastus'].namespace"`
   • D`az provider list --query "[?registrationState=='Registered'].namespace"`
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A penetration tester is mapping a microservices-based application on AWS. The application uses Amazon ECS with Fargate, an Application Load Balancer (ALB), and an RDS database. The tester needs to identify the ECS services, the tasks running behind the ALB, and the database connections. The tester has read-only access to ECS, ELBv2, and RDS. Which sequence of AWS CLI commands would be most efficient?

   • A`aws ecs list-services` → `aws ecs describe-services` → `aws elbv2 describe-target-groups` → `aws rds describe-db-instances`
   • B`aws elbv2 describe-target-groups` → `aws elbv2 describe-target-health` → `aws ecs list-services` → `aws ecs describe-services` → `aws rds describe-db-instances`
   • C`aws rds describe-db-instances` → `aws ecs list-services` → `aws elbv2 describe-target-groups`
   • D`aws elbv2 describe-load-balancers` → `aws elbv2 describe-listeners` → `aws ecs list-services` → `aws rds describe-db-instances`
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   You are mapping a web application hosted on an AWS EC2 instance behind an Application Load Balancer. The application appears to be a custom API. You need to identify the underlying web server and framework versions without triggering intrusive scans. Which technique is most appropriate?

   • AUse `whatweb` with the `--aggression 3` flag to perform aggressive plugin checks.
   • BInspect HTTP response headers and the `Server` header, and fetch common static files like `/robots.txt` and `/favicon.ico`.
   • CSend a series of malformed HTTP requests to provoke error pages that reveal server banners.
   • DRun `nmap -sV` against the load balancer's public IP to identify the service version.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   You are conducting a penetration test of an AWS environment. You have been given two sets of credentials: one for a read-only user in the production account and one for an admin user in a separate 'security' account. You need to enumerate resources in the production account, but the read-only user can only assume a role in the production account. Which approach should you use?

   • AUse the admin credentials to create a new access key for the read-only user.
   • BUse the admin credentials to directly access the production account via the AWS Management Console.
   • CUse the read-only user's credentials to call `aws iam list-roles` in the production account.
   • DConfigure a profile for the read-only user and use `aws sts assume-role` to assume the role in the production account.
   Reveal Solution Discussion Select an answer first