A penetration tester is assessing a serverless application on AWS Lambda. The tester discovers that the Lambda function has an environment variable containing a database password. Which of the following is the most likely misconfiguration that allowed the tester to view this variable?

The Lambda function uses a customer-managed key for encryption

The Lambda function is configured with a VPC but no internet access

The Lambda function is publicly accessible via a function URL

The Lambda function's execution role has 'lambda:GetFunction' permission for all users

Which technique is commonly used to discover undocumented or hidden cloud API endpoints?

Reading the cloud provider's terms of service

Analyzing the target's financial statements

Fuzzing API parameters and paths

Performing social engineering on developers

You are performing reconnaissance on a target that uses Azure. You have discovered a custom domain that points to an Azure Front Door endpoint. You want to enumerate the backend origin servers behind the Front Door. Which technique is most likely to reveal the origin IP addresses?

Use a DNS history service to find historical A records for the custom domain

Perform a port scan on the Front Door IP address

Query the Azure REST API for Front Door backend pools

Check the TLS certificate presented by the Front Door for additional SANs

What is the purpose of the cloud metadata service in a penetration test?

To store persistent configuration files for applications

To route network traffic between cloud services

To manage user authentication for cloud console access

To provide instance metadata and temporary credentials to cloud resources

GIAC Cloud Penetration Tester

Domain 2Objective 1

Discovering Cloud Services and Data GCPN Practice Questions (Page 1)

Part of the Cloud Service Discovery and Reconnaissance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 1–5

1foundation · easy
Which IP address is commonly associated with the cloud metadata service in AWS?
Select an answer first
2expert · hard
A penetration tester is assessing a serverless application on AWS Lambda. The tester discovers that the Lambda function has an environment variable containing a database password. Which of the following is the most likely misconfiguration that allowed the tester to view this variable?
Select an answer first
3foundation · easy
Which technique is commonly used to discover undocumented or hidden cloud API endpoints?
Select an answer first
4expert · hard
You are performing reconnaissance on a target that uses Azure. You have discovered a custom domain that points to an Azure Front Door endpoint. You want to enumerate the backend origin servers behind the Front Door. Which technique is most likely to reveal the origin IP addresses?
Select an answer first
5foundation · easy
What is the purpose of the cloud metadata service in a penetration test?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.