A penetration tester is mapping a multi-tier application on GCP. The application consists of a load balancer, Compute Engine instances in a managed instance group, and a Cloud SQL database. The tester has read-only access to Compute Engine, Cloud SQL, and the load balancer. The tester needs to create a comprehensive map of the application, including the load balancer's backend services, the instance group, and the Cloud SQL database that the instances connect to. Which sequence of gcloud commands would be most efficient?

`gcloud sql instances list` → `gcloud compute instances list` → `gcloud compute backend-services list`

`gcloud compute backend-services list` → `gcloud compute backend-services describe --region ` → `gcloud compute instance-groups list` → `gcloud compute instances list` → `gcloud sql instances list`

`gcloud compute forwarding-rules list` → `gcloud compute target-pools list` → `gcloud compute instances list`

`gcloud compute instances list` → `gcloud sql instances list` → `gcloud compute backend-services list`

Which of the following is a typical output of application mapping?

A list of all open ports on the internet

A diagram showing the application's components and their interactions

You are fingerprinting a web application that is behind a WAF. The WAF blocks requests with suspicious user agents and drops requests that contain SQL keywords. You need to identify the application framework without being blocked. Which technique is most likely to succeed?

Send a request with a SQL injection payload in the URL to trigger an error page.

Send a request with a custom user agent like 'Fingerprinter'.

Use a common browser user agent and request a static resource like `/favicon.ico`.

Use `sqlmap` to fingerprint the backend database.

GIAC Cloud Penetration Tester

Domain 2Objective 2

Cloud CLI and Application Mapping GCPN Practice Questions (Page 5)

Part of the Cloud Service Discovery and Reconnaissance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

9concepts

Questions 21–25

21expert · hard
A penetration tester is mapping a multi-tier application on GCP. The application consists of a load balancer, Compute Engine instances in a managed instance group, and a Cloud SQL database. The tester has read-only access to Compute Engine, Cloud SQL, and the load balancer. The tester needs to create a comprehensive map of the application, including the load balancer's backend services, the instance group, and the Cloud SQL database that the instances connect to. Which sequence of gcloud commands would be most efficient?
Select an answer first
22foundation · easy
Which AWS CLI command is used to list available AWS services?
Select an answer first
23foundation · easy
Which of the following is a typical output of application mapping?
Select an answer first
24expert · hard
You are fingerprinting a web application that is behind a WAF. The WAF blocks requests with suspicious user agents and drops requests that contain SQL keywords. You need to identify the application framework without being blocked. Which technique is most likely to succeed?
Select an answer first
25foundation · easy
A penetration tester needs to list all Amazon S3 buckets in an AWS account using the AWS CLI. Which command accomplishes this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Cloud CLI and Application Mapping GCPN Practice Questions (Page 5)

Questions 21–25

Which AWS CLI command is used to list available AWS services?

Which of the following is a typical output of application mapping?

You are fingerprinting a web application that is behind a WAF. The WAF blocks requests with suspicious user agents and drops requests that contain SQL keywords. You need to identify the application framework without being blocked. Which technique is most likely to succeed?

A penetration tester needs to list all Amazon S3 buckets in an AWS account using the AWS CLI. Which command accomplishes this?

Keep studying — Cloud Service Discovery and Reconnaissance