What is the purpose of cloud service fingerprinting?

To determine the cloud provider, region, and service types used by a target

To identify the physical hardware vendor of cloud servers

To bypass cloud service authentication mechanisms

To measure the performance of cloud services

Which public source is commonly mined to discover cloud assets during reconnaissance?

The target's employee social media profiles

What is the typical result of a cloud service misconfiguration that allows unauthorized access?

Exposure of sensitive data or unauthorized use of cloud resources

Automatic patching of the service

Improved performance of the cloud service

A client wants you to identify any cloud storage buckets that may have been exposed in public code repositories. You have access to the client's GitHub organization and permission to search for storage bucket names. Which approach is most effective?

Perform a DNS brute-force on the organization's domain for common bucket names

Clone all repositories and run `grep` for `bucket`

Use a certificate transparency log search for the organization's domain

Use GitHub's code search API to search for patterns like `s3.amazonaws.com` or `blob.core.windows.net` within the organization's repositories

A security analyst is testing the security of a target's Azure Blob storage. They find a storage account named 'acmeassets' and want to check if any containers are publicly accessible. Which of the following is the most efficient method?

Use the Azure REST API to enumerate all containers in the account

Use the Azure CLI to run 'az storage container list' with the account key

Perform a DNS lookup on the storage account to find container names

Try to access the container URL directly in a browser, e.g., 'https://acmeassets.blob.core.windows.net/container?restype=container&comp=list'

GIAC Cloud Penetration Tester

Domain 2Objective 1

Discovering Cloud Services and Data GCPN Practice Questions (Page 5)

Part of the Cloud Service Discovery and Reconnaissance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 21–25

21foundation · easy
What is the purpose of cloud service fingerprinting?
Select an answer first
22foundation · easy
Which public source is commonly mined to discover cloud assets during reconnaissance?
Select an answer first
23foundation · easy
What is the typical result of a cloud service misconfiguration that allows unauthorized access?
Select an answer first
24application · medium
A client wants you to identify any cloud storage buckets that may have been exposed in public code repositories. You have access to the client's GitHub organization and permission to search for storage bucket names. Which approach is most effective?
Select an answer first
25application · medium
A security analyst is testing the security of a target's Azure Blob storage. They find a storage account named 'acmeassets' and want to check if any containers are publicly accessible. Which of the following is the most efficient method?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.