Cloud Penetration Testing Fundamentals GCPN Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A penetration tester is planning a cloud assessment for a client that uses AWS. The client wants to test the security of their S3 buckets, IAM roles, and EC2 instances. The tester has been given read-only access to the AWS account. Which testing activity is most appropriate given this access level?

   • AAttempt to modify IAM policies to see if the read-only access can be escalated.
   • BReview the S3 bucket policies, IAM roles, and EC2 security groups for misconfigurations.
   • CLaunch new EC2 instances to test for weak passwords.
   • DDownload all S3 objects to test for sensitive data exposure.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A penetration tester is conducting an assessment of a client's AWS environment. The client has provided a detailed scope that includes specific EC2 instances and RDS databases. The tester discovers that one of the RDS databases is publicly accessible. What should the tester do next?

   • ADocument the public exposure and include it in the final report as a finding.
   • BImmediately stop the test and notify the client's security team.
   • CExpand the scope to include the RDS database and test it thoroughly.
   • DAttempt to exploit the public RDS database to demonstrate the risk.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A cloud penetration tester is assessing an Azure subscription. The tester has been granted the 'Reader' role on the subscription. The goal is to identify security misconfigurations. Which testing activity is most appropriate?

   • AAttempt to create a new virtual machine to test for privilege escalation.
   • BReview the Azure Activity Logs to identify suspicious activities and misconfigurations.
   • CRun a network scan from the tester's workstation to discover all Azure resources.
   • DUse Azure CLI to reset the password of an existing VM.
   Reveal Solution Discussion Select an answer first
5. 14foundation · medium

   Which statement best describes a key difference between cloud penetration testing and traditional on-premises penetration testing?

   • ACloud penetration testing always requires physical access to the data center.
   • BCloud penetration testing involves testing resources that are provisioned and managed through a cloud provider's API and console.
   • CCloud penetration testing requires explicit authorization from the cloud provider for testing the provider's managed services.
   • DCloud penetration testing focuses only on the customer's own virtual machines and ignores all shared services.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A penetration tester is conducting an assessment of a cloud environment that uses Infrastructure as Code (IaC) to deploy resources. The client wants to ensure that the testing covers the security of the IaC templates themselves. Which activity should the tester include?

   • AReview the IaC templates for hard-coded secrets, overly permissive IAM policies, and insecure default configurations.
   • BTest the IaC templates by deploying them in a production environment and then attacking the deployed resources.
   • CPerform a denial-of-service attack against the IaC deployment pipeline.
   • DRun a vulnerability scanner against the IaC templates to find known CVEs.
   Reveal Solution Discussion Select an answer first