A penetration tester is analyzing a target's DNS records and finds a CNAME record pointing to 'example.azureedge.net'. What does this indicate, and what is the most likely underlying service?

The target uses AWS CloudFront; the CNAME points to a CloudFront distribution

The target uses a reverse proxy; the CNAME points to a proxy server

The target uses Azure CDN; the CNAME points to a CDN endpoint

The target uses Google Cloud CDN; the CNAME points to a Google CDN endpoint

Which cloud-specific API is commonly used to enumerate a target's exposed cloud services during reconnaissance?

Microsoft Graph API for user profiles

A security analyst is performing passive reconnaissance on a target that uses AWS. They find a public GitHub repository belonging to an employee that contains a configuration file with a hardcoded AWS access key ID. What is the most effective way to determine if the key is still valid?

Check the key's creation date in the IAM console

Try to list S3 buckets using the key

Search for the key in public breach databases

Use the AWS CLI to call 'sts get-caller-identity' with the key

A client wants you to identify any Azure Blob containers that may be publicly accessible. You have been given the organization's domain name and permission to perform passive reconnaissance. Which technique is most effective for discovering Azure Blob storage accounts without making direct requests to Azure?

Search certificate transparency logs for `*.blob.core.windows.net` subdomains

Query the Azure REST API for a list of all storage accounts under the domain

Use DNS brute-force on the domain to find `storage` subdomains

Enumerate common storage account names using a wordlist against `*.blob.core.windows.net`

During an external assessment of a target organization, you find a GitHub repository that contains a configuration file with an AWS S3 bucket name and a region. You want to confirm the bucket exists and is publicly accessible without making authenticated requests. Which approach is most appropriate?

Use `nslookup bucket-name.s3.amazonaws.com` to check DNS resolution

Run `aws s3 ls s3://bucket-name --no-sign-request --region us-east-1`

Use `curl https://bucket-name.s3.amazonaws.com/` and check for an AccessDenied error

Run `aws s3api get-bucket-acl --bucket bucket-name --region us-east-1`

GIAC Cloud Penetration Tester

Domain 2Objective 1

Discovering Cloud Services and Data GCPN Practice Questions (Page 3)

Part of the Cloud Service Discovery and Reconnaissance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 11–15

11application · easy
A penetration tester is analyzing a target's DNS records and finds a CNAME record pointing to 'example.azureedge.net'. What does this indicate, and what is the most likely underlying service?
Select an answer first
12foundation · easy
Which cloud-specific API is commonly used to enumerate a target's exposed cloud services during reconnaissance?
Select an answer first
13application · medium
A security analyst is performing passive reconnaissance on a target that uses AWS. They find a public GitHub repository belonging to an employee that contains a configuration file with a hardcoded AWS access key ID. What is the most effective way to determine if the key is still valid?
Select an answer first
14application · medium
A client wants you to identify any Azure Blob containers that may be publicly accessible. You have been given the organization's domain name and permission to perform passive reconnaissance. Which technique is most effective for discovering Azure Blob storage accounts without making direct requests to Azure?
Select an answer first
15application · medium
During an external assessment of a target organization, you find a GitHub repository that contains a configuration file with an AWS S3 bucket name and a region. You want to confirm the bucket exists and is publicly accessible without making authenticated requests. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Discovering Cloud Services and Data GCPN Practice Questions (Page 3)

Questions 11–15

A penetration tester is analyzing a target's DNS records and finds a CNAME record pointing to 'example.azureedge.net'. What does this indicate, and what is the most likely underlying service?

Which cloud-specific API is commonly used to enumerate a target's exposed cloud services during reconnaissance?

A security analyst is performing passive reconnaissance on a target that uses AWS. They find a public GitHub repository belonging to an employee that contains a configuration file with a hardcoded AWS access key ID. What is the most effective way to determine if the key is still valid?

Keep studying — Cloud Service Discovery and Reconnaissance