Cloud Penetration Testing Fundamentals GCPN Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A cloud penetration tester is assessing a client's Azure environment. The client wants to test the security of their Azure Kubernetes Service (AKS) cluster and Azure Container Registry (ACR). The tester has been given Contributor permissions on the AKS cluster and ACR. What is a key consideration when testing containerized workloads in the cloud?

   • ATesting should focus only on the AKS cluster's API server because it is the main attack surface.
   • BContainerized workloads do not require testing because the cloud provider secures the container runtime.
   • CContainer images should be scanned for vulnerabilities, and the cluster's RBAC and network policies should be tested.
   • DThe tester should use the same testing methodology as for traditional virtual machines.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A penetration tester is assessing a Google Cloud Platform (GCP) project. The tester needs to test the security of a Compute Engine instance that hosts a web application. The tester has been given Owner IAM permissions on the project. What is the most important consideration when planning the test to avoid violating GCP's terms of service?

   • AUse only open-source tools to avoid licensing issues.
   • BRun the test from a VM in the same project to reduce latency.
   • CRequest approval from Google Cloud support before starting the test.
   • DEnsure that the test does not involve denial-of-service attacks against GCP infrastructure.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A cloud penetration tester is planning an assessment for a client's GCP environment. The client wants to test the security of their Kubernetes Engine (GKE) cluster and Cloud Storage buckets. The tester has been given the role of Security Reviewer on the project. What is the primary objective of the penetration test in this scenario?

   • ADemonstrate that the tester can access the GCP project using the provided credentials.
   • BIdentify vulnerabilities and misconfigurations in the GKE cluster and Cloud Storage buckets that could be exploited by an attacker.
   • CEnsure that the GKE cluster and Cloud Storage buckets are configured according to GCP's best practices.
   • DVerify that the client's security team can detect and respond to the test activities.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A cloud penetration tester is assessing a serverless application that uses AWS Lambda and API Gateway. The client wants to test the security of the application, but the tester has no access to the Lambda function code. The tester only has the API endpoint URL and a set of test credentials. Which testing approach is most effective?

   • ARequest access to the Lambda function code from the client to perform a white-box review.
   • BAttempt to access the Lambda execution environment to extract the code.
   • CRun a vulnerability scanner against the API endpoint to identify known CVEs.
   • DPerform black-box testing of the API endpoints, including fuzzing and injection attacks.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security consultant is conducting a penetration test for a client's AWS environment. The client wants to test the security of their S3 buckets and EC2 instances. The consultant has been granted IAM credentials with read-only access to the account. Which of the following is a key difference between cloud penetration testing and traditional on-premises testing that the consultant must account for?

   • ACloud testing is limited to testing the virtual machines and does not include network or application layers.
   • BCloud testing does not require any authorization from the cloud provider, only from the client.
   • CCloud testing requires physical access to the data center to test the infrastructure.
   • DCloud testing often requires working with the cloud provider's shared responsibility model and may involve testing APIs and IAM configurations.
   Reveal Solution Discussion Select an answer first