Cloud Penetration Testing Fundamentals GCPN Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A penetration tester is planning a test for a client's GCP environment. The client wants to test the security of their Cloud SQL database and Cloud Storage bucket. The tester has been given the role of Cloud SQL Admin and Storage Admin. What is the primary objective of the test in this scenario?

   • AVerify that the Cloud SQL database is performing optimally and the Cloud Storage bucket is accessible.
   • BTest the network connectivity between the Cloud SQL database and the Cloud Storage bucket.
   • CIdentify misconfigurations in the Cloud SQL database and Cloud Storage bucket that could lead to unauthorized access.
   • DEnsure that the Cloud SQL database and Cloud Storage bucket are configured according to GCP's best practices.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A penetration tester is engaged to assess a client's multi-cloud environment that includes AWS and Azure. The client has a strict requirement that the test must not cause any disruption to production services. The tester needs to test the security of an S3 bucket and an Azure Blob storage container that contain sensitive data. Which approach best balances the need for thorough testing with the constraint of no disruption?

   • ADelete the S3 bucket and Azure Blob container and recreate them to test the configuration.
   • BAttempt to modify the data in the S3 bucket and Azure Blob container to test write permissions.
   • CTest only the network layer and avoid testing the storage services to prevent any risk.
   • DPerform read-only testing on the S3 bucket and Azure Blob container to identify misconfigurations without modifying data.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A cloud penetration tester is planning an assessment for a client's Azure environment. The client has a requirement that the test must not affect the availability of their production applications. The tester needs to test the security of an Azure App Service and an Azure SQL database. Which approach is most appropriate to meet the availability constraint?

   • APerform the test during a maintenance window when the applications are already scheduled for downtime.
   • BUse a staging environment that mirrors the production configuration for testing.
   • CSkip testing the Azure SQL database because it is a managed service and does not need testing.
   • DTest the production environment but only during off-peak hours.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A cloud penetration tester is assessing a client's GCP environment. The client has a requirement that the test must be completed within a limited time frame and with minimal cost. The tester needs to test the security of a Compute Engine instance and a Cloud SQL database. The tester has been given Owner IAM permissions. Which approach is most efficient and cost-effective while still providing a meaningful assessment?

   • AFocus only on the Cloud SQL database because Compute Engine instances are automatically secure.
   • BPerform a full manual penetration test of all services in the project, including those not in scope.
   • CUse automated scanning tools to identify common misconfigurations in the Compute Engine instance and Cloud SQL database.
   • DSpin up additional Compute Engine instances to test the security of the environment.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A penetration tester is engaged to assess a client's AWS environment. The client has a compliance requirement that the test must not involve any activity that could be considered a denial-of-service attack. The tester needs to test the security of an EC2 instance that hosts a critical application. Which testing technique is most appropriate under this constraint?

   • AUse a tool like Metasploit to exploit known vulnerabilities in the application.
   • BConduct a stress test on the EC2 instance to see how it handles high traffic.
   • CPerform a vulnerability scan of the EC2 instance using a tool like Nessus or OpenVAS.
   • DAttempt to crash the application by sending malformed requests.
   Reveal Solution Discussion Select an answer first