You are performing reconnaissance on a target and notice that the target's website returns a TLS certificate with a common name that includes `*.appspot.com`. You also observe that the IP address resolves to a Google Cloud IP range. Which conclusion is most accurate?

The application is using Google Cloud Storage for static content

The application is hosted on Google Kubernetes Engine

The application is behind Google Cloud CDN

The application is likely hosted on Google App Engine

During reconnaissance, you find a hostname 'storage.googleapis.com' in the target's DNS records. You also find a certificate for '*.appspot.com' in certificate transparency logs. Which cloud provider and services are most likely in use?

Google Cloud Platform with Cloud Storage and App Engine

Microsoft Azure with Blob Storage and App Service

IBM Cloud with Object Storage and Cloud Foundry

AWS with S3 and Elastic Beanstalk

A cloud security auditor is reviewing a target's AWS S3 configuration. They find that an S3 bucket policy allows 's3:PutObject' for the 'AllUsers' group. What is the most significant risk, and what is the best remediation?

Attackers can launch a denial-of-service attack by filling the bucket; enable versioning

Attackers can access the bucket's ACL; use bucket policies instead of ACLs

Attackers can overwrite existing objects, leading to data integrity issues; remove the 'AllUsers' permission from the bucket policy

Attackers can read sensitive data; enable encryption on the bucket

Which of the following is an indicator that can be used to fingerprint a cloud service?

The color scheme of the target's website

The number of employees at the target company

A penetration tester is tasked with enumerating cloud services for a target that uses multiple providers. They have identified an AWS account ID from a public S3 bucket policy. Which of the following is the most effective way to discover additional AWS resources associated with that account?

Use the AWS API to enumerate all resources in the account

Search for the account ID in public GitHub repositories and pastebin

Use the AWS IP range API to find resources in the account

Perform a DNS brute-force on the account ID's domain

GIAC Cloud Penetration Tester

Domain 2Objective 1

Discovering Cloud Services and Data GCPN Practice Questions (Page 2)

Part of the Cloud Service Discovery and Reconnaissance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 6–10

6application · medium
You are performing reconnaissance on a target and notice that the target's website returns a TLS certificate with a common name that includes `*.appspot.com`. You also observe that the IP address resolves to a Google Cloud IP range. Which conclusion is most accurate?
Select an answer first
7application · easy
During reconnaissance, you find a hostname 'storage.googleapis.com' in the target's DNS records. You also find a certificate for '*.appspot.com' in certificate transparency logs. Which cloud provider and services are most likely in use?
Select an answer first
8expert · hard
A cloud security auditor is reviewing a target's AWS S3 configuration. They find that an S3 bucket policy allows 's3:PutObject' for the 'AllUsers' group. What is the most significant risk, and what is the best remediation?
Select an answer first
9foundation · easy
Which of the following is an indicator that can be used to fingerprint a cloud service?
Select an answer first
10application · medium
A penetration tester is tasked with enumerating cloud services for a target that uses multiple providers. They have identified an AWS account ID from a public S3 bucket policy. Which of the following is the most effective way to discover additional AWS resources associated with that account?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.