What information can web application fingerprinting reveal?

The web server software and its version

The application's business logic

A penetration tester is assessing a GCP project and has discovered that the project has a Cloud Function that processes sensitive data. The tester needs to extract the environment variables and configuration of the Cloud Function to understand its dependencies and potential attack surface. The tester has the `roles/cloudfunctions.viewer` role. Which command should the tester run?

`gcloud functions call --region `

`gcloud functions list --region `

`gcloud functions describe --region `

`gcloud functions logs read --region `

A cloud penetration tester is conducting an assessment of an Azure subscription. The tester has been provided with a service principal's client ID and secret, but no other credentials. The tester wants to enumerate all virtual machines and storage accounts in the subscription using the Azure CLI. What is the first command sequence the tester should run?

`az login` then `az vm list --all` and `az storage account list --all`

`az login --service-principal -u -p --tenant ` then `az vm list` and `az storage account list`

`az account set --subscription ` then `az vm list` and `az storage account list`

`az ad sp create-for-rbac -n ` then `az vm list` and `az storage account list`

What is the primary purpose of application mapping in cloud penetration testing?

To test the application's performance under load

To create a list of user credentials

To identify all components, dependencies, and communication paths of an application

To exploit vulnerabilities in the application

GIAC Cloud Penetration Tester

Domain 2Objective 2

Cloud CLI and Application Mapping GCPN Practice Questions (Page 6)

Part of the Cloud Service Discovery and Reconnaissance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

9concepts

Questions 26–30

26foundation · easy
What information can web application fingerprinting reveal?
Select an answer first
27expert · medium
A penetration tester is assessing a GCP project and has discovered that the project has a Cloud Function that processes sensitive data. The tester needs to extract the environment variables and configuration of the Cloud Function to understand its dependencies and potential attack surface. The tester has the `roles/cloudfunctions.viewer` role. Which command should the tester run?
Select an answer first
28foundation · easy
Which Azure CLI command lists all storage accounts in a subscription?
Select an answer first
29application · medium
A cloud penetration tester is conducting an assessment of an Azure subscription. The tester has been provided with a service principal's client ID and secret, but no other credentials. The tester wants to enumerate all virtual machines and storage accounts in the subscription using the Azure CLI. What is the first command sequence the tester should run?
Select an answer first
30foundation · easy
What is the primary purpose of application mapping in cloud penetration testing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Cloud CLI and Application Mapping GCPN Practice Questions (Page 6)

Questions 26–30

What information can web application fingerprinting reveal?

Which Azure CLI command lists all storage accounts in a subscription?

What is the primary purpose of application mapping in cloud penetration testing?

Keep studying — Cloud Service Discovery and Reconnaissance