A penetration tester is assessing a client's GCP environment. The client has a requirement that the test must not incur additional costs beyond the tester's time. The tester needs to test the security of a Cloud Storage bucket and a Cloud Function. Which approach is most cost-effective while still providing a meaningful assessment?

Use the gcloud CLI to manually inspect the bucket and function configurations.

Use a third-party scanning service that charges per scan.

Create a new Cloud Function to test the security of the existing function.

Enable Cloud Audit Logging to monitor the test activities.

What is a primary objective of a cloud penetration test?

To identify misconfigurations and vulnerabilities in the customer's cloud-deployed resources.

To ensure the cloud provider's hypervisor is free from known vulnerabilities.

To verify the cloud provider's physical security controls at their data centers.

To guarantee that the cloud environment is completely free of all security risks.

A cloud penetration tester is assessing a hybrid cloud environment where an on-premises data center is connected to a public cloud via a VPN. The client wants to test the security of the connection. Which testing activity is most appropriate?

Perform a denial-of-service attack on the VPN endpoint to test its resilience.

Attempt to intercept the VPN traffic to test for encryption weaknesses.

Scan the on-premises network through the VPN to find vulnerabilities.

Review the VPN configuration for weak encryption protocols, improper authentication, and misconfigured routing.

A penetration tester is planning a test for a client's AWS environment. The client has a requirement that the test must not involve any activity that could be considered a denial-of-service attack. The tester needs to test the security of an S3 bucket and an EC2 instance. Which testing technique is most appropriate under this constraint?

Attempt to upload a large file to the S3 bucket to test write permissions.

Perform a read-only review of the S3 bucket policies and EC2 security groups.

Use a tool like sqlmap to test the EC2 instance for SQL injection vulnerabilities.

Run a network stress test against the EC2 instance to test its resilience.

A cloud penetration tester is planning an assessment for a client's Azure environment. The client wants to test the security of their Azure Active Directory (now Microsoft Entra ID) and Azure VMs. The tester has been given Global Reader permissions. What is the primary objective of the test in this scenario?

Test the performance of the Azure VMs under load.

Identify misconfigurations in Entra ID and Azure VMs that could lead to unauthorized access.

Verify that the Azure VMs are running the latest operating system updates.

Ensure that the Entra ID tenant is configured according to Azure's best practices.

GIAC Cloud Penetration Tester

Domain 1Objective 1

Cloud Penetration Testing Fundamentals GCPN Practice Questions (Page 5)

Part of the Cloud Penetration Testing Fundamentals domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 4–7 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

1concept

Questions 21–25

21expert · hard
A penetration tester is assessing a client's GCP environment. The client has a requirement that the test must not incur additional costs beyond the tester's time. The tester needs to test the security of a Cloud Storage bucket and a Cloud Function. Which approach is most cost-effective while still providing a meaningful assessment?
Select an answer first
22foundation · medium
What is a primary objective of a cloud penetration test?
Select an answer first
23application · medium
A cloud penetration tester is assessing a hybrid cloud environment where an on-premises data center is connected to a public cloud via a VPN. The client wants to test the security of the connection. Which testing activity is most appropriate?
Select an answer first
24expert · hard
A penetration tester is planning a test for a client's AWS environment. The client has a requirement that the test must not involve any activity that could be considered a denial-of-service attack. The tester needs to test the security of an S3 bucket and an EC2 instance. Which testing technique is most appropriate under this constraint?
Select an answer first
25application · medium
A cloud penetration tester is planning an assessment for a client's Azure environment. The client wants to test the security of their Azure Active Directory (now Microsoft Entra ID) and Azure VMs. The tester has been given Global Reader permissions. What is the primary objective of the test in this scenario?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Cloud Penetration Testing Fundamentals GCPN Practice Questions (Page 5)

Questions 21–25

What is a primary objective of a cloud penetration test?

A cloud penetration tester is assessing a hybrid cloud environment where an on-premises data center is connected to a public cloud via a VPN. The client wants to test the security of the connection. Which testing activity is most appropriate?

Keep studying — Cloud Penetration Testing Fundamentals