Cloud Penetration Testing Fundamentals GCPN Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A penetration tester is assessing a multi-cloud environment that includes AWS and Azure. The tester has been asked to evaluate the security of the identity and access management (IAM) configurations in both clouds. Which approach best aligns with the objectives of cloud penetration testing?

   • AUse the same on-premises penetration testing methodology for both clouds to ensure consistency.
   • BFocus only on the network layer because IAM is the customer's responsibility and not part of the test.
   • CTest the IAM policies and roles in each cloud separately, using the provider-specific tools and APIs.
   • DTest only the Azure IAM because AWS IAM is inherently secure.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration tester is planning a test for a client's AWS environment. The client wants to test the security of their Lambda functions and API Gateway endpoints. The tester has been given IAM credentials with permissions to invoke Lambda functions and access API Gateway. What is the primary objective of the test in this scenario?

   • AIdentify vulnerabilities in the Lambda function code and API Gateway configurations that could lead to unauthorized access.
   • BEnsure that the API Gateway endpoints are publicly accessible to test the security of the network.
   • CVerify that the Lambda functions are invoked correctly and return the expected responses.
   • DTest the performance of the Lambda functions under load.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A penetration tester is assessing a client's GCP environment. The client wants to test the security of their Cloud Functions and Cloud Run services. The tester has been given the role of Cloud Functions Admin and Cloud Run Admin. What is a key consideration when testing serverless services like Cloud Functions and Cloud Run?

   • AServerless services are automatically secure and do not require penetration testing.
   • BThe tester should focus on the function code, event triggers, and IAM permissions that control access to the services.
   • CTesting serverless services requires the same methodology as testing traditional virtual machines.
   • DServerless services do not have any attack surface because the provider manages the infrastructure.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company is moving its on-premises data center to a public cloud. The security team wants to conduct a penetration test of the new cloud environment. They have a traditional on-premises testing methodology that includes physical security checks and network sniffing on the local LAN. Which adjustment is most important when adapting the methodology to the cloud?

   • AFocus only on the application layer and ignore network-level testing because the cloud provider manages the network.
   • BReplace physical security checks with reviews of the cloud provider's physical security certifications and compliance reports.
   • CPerform the same physical security checks on the cloud provider's data centers.
   • DKeep the same methodology because the cloud is just someone else's data center.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A penetration tester is assessing a cloud environment that uses a private cloud on dedicated hardware. The client wants to test the security of the hypervisor and the physical network. The tester has been given administrative access to the hypervisor management console. Which testing approach is most appropriate?

   • AAttempt to escape the hypervisor to access the host operating system.
   • BReview the hypervisor configuration for insecure defaults, patch levels, and network segmentation.
   • CPerform a network scan of the physical network to discover all connected devices.
   • DTest the security of the virtual machines by launching new instances.
   Reveal Solution Discussion Select an answer first