A penetration tester is performing reconnaissance on a target that uses Google Cloud Platform. They find a DNS TXT record with 'google-site-verification=...' and a certificate for '*.appspot.com'. What is the most likely combination of services?

Google Cloud Storage and Google Compute Engine

Google Cloud Run and Google Cloud CDN

Google App Engine and Google Cloud Storage

Google Kubernetes Engine and Google Cloud Functions

During reconnaissance, you notice that a target's web application returns HTTP headers that include `Server: nginx` and the TLS certificate is issued by a certificate authority that is only used by a specific cloud provider. You also observe that the IP address range is registered to that same cloud provider. Which conclusion is most defensible?

The application is behind a content delivery network (CDN) operated by that provider

The application is using a serverless function

The application is hosted on that cloud provider's infrastructure

The application is running in a container orchestration platform like Kubernetes

During a cloud penetration test, an assessor wants to identify which cloud services a target organization exposes to the internet. Which approach is most directly aligned with cloud service enumeration?

Intercepting and analyzing the target's internal network traffic to map service dependencies

Querying the target's public DNS records and scanning discovered IP ranges for open ports and service banners

Deploying a rogue cloud instance in the same region as the target to observe its traffic

Reviewing the target's financial filings to infer cloud spending and service usage

During a cloud assessment, you find an Azure Blob container that has the access level set to `Blob` (anonymous read access for blobs only). You also notice that the storage account's firewall is configured to allow access from all networks. Which statement best describes the accessibility of the blobs?

Blobs in the container are accessible to anyone who knows the blob URL

Blobs are accessible only from within the same Azure region

Blobs are accessible only to authenticated Azure users

Blobs are not accessible because the container is not publicly listed

You are testing an AWS account and find an S3 bucket that allows `s3:GetObject` to `*` (everyone). However, the bucket policy also includes a condition that restricts access to a specific VPC endpoint. Which statement best describes the accessibility of the bucket?

The bucket is accessible only from within the same AWS region

The bucket is only accessible from the specified VPC endpoint, not from the public internet

The bucket is accessible only from the VPC where the endpoint is created, but not from other VPCs

The bucket is publicly accessible from anywhere because the principal is `*`

GIAC Cloud Penetration Tester

Domain 2Objective 1

Discovering Cloud Services and Data GCPN Practice Questions (Page 4)

Part of the Cloud Service Discovery and Reconnaissance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 16–20

16application · easy
A penetration tester is performing reconnaissance on a target that uses Google Cloud Platform. They find a DNS TXT record with 'google-site-verification=...' and a certificate for '*.appspot.com'. What is the most likely combination of services?
Select an answer first
17application · medium
During reconnaissance, you notice that a target's web application returns HTTP headers that include `Server: nginx` and the TLS certificate is issued by a certificate authority that is only used by a specific cloud provider. You also observe that the IP address range is registered to that same cloud provider. Which conclusion is most defensible?
Select an answer first
18foundation · easy
During a cloud penetration test, an assessor wants to identify which cloud services a target organization exposes to the internet. Which approach is most directly aligned with cloud service enumeration?
Select an answer first
19application · medium
During a cloud assessment, you find an Azure Blob container that has the access level set to `Blob` (anonymous read access for blobs only). You also notice that the storage account's firewall is configured to allow access from all networks. Which statement best describes the accessibility of the blobs?
Select an answer first
20application · medium
You are testing an AWS account and find an S3 bucket that allows `s3:GetObject` to `*` (everyone). However, the bucket policy also includes a condition that restricts access to a specific VPC endpoint. Which statement best describes the accessibility of the bucket?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Discovering Cloud Services and Data GCPN Practice Questions (Page 4)

Questions 16–20

A penetration tester is performing reconnaissance on a target that uses Google Cloud Platform. They find a DNS TXT record with 'google-site-verification=...' and a certificate for '*.appspot.com'. What is the most likely combination of services?

During a cloud penetration test, an assessor wants to identify which cloud services a target organization exposes to the internet. Which approach is most directly aligned with cloud service enumeration?

You are testing an AWS account and find an S3 bucket that allows `s3:GetObject` to `*` (everyone). However, the bucket policy also includes a condition that restricts access to a specific VPC endpoint. Which statement best describes the accessibility of the bucket?

Keep studying — Cloud Service Discovery and Reconnaissance