During a cloud penetration test, you discover that a target organization uses AWS S3 buckets for backups. You find a bucket name 'acme-backup-2023' via a public GitHub repository. You attempt to list the bucket and receive an 'AccessDenied' error. What is the most likely reason for this error, and what should you do next?

The bucket is configured with a bucket policy that denies public access; attempt to access individual objects if you can guess names

The bucket does not exist; try a different bucket name

The bucket is in a different region; use the correct regional endpoint

The bucket is encrypted; you need the encryption key to list it

What is the goal of cloud API reconnaissance?

To test the performance of cloud APIs under load

To map the attack surface by enumerating cloud provider APIs and endpoints

To monitor API usage for billing purposes

To create API documentation for the target organization

A security analyst is investigating a suspicious IP address that is communicating with a target's network. The analyst wants to determine if the IP belongs to a cloud provider and which region it is in. Which of the following is the most reliable method?

Perform a reverse DNS lookup on the IP address

Use a geolocation database to determine the IP's physical location

Use the cloud provider's IP range API to check if the IP falls within a known range

Use a WHOIS lookup to find the IP's owner

During a cloud assessment, you are asked to enumerate the cloud services used by a target organization. You have the organization's ASN and permission to perform passive reconnaissance. Which technique is most effective for identifying cloud services hosted on that ASN?

Use a search engine to find subdomains of the organization's domain

Perform an active port scan of all IPs in the ASN

Query the organization's WHOIS record for cloud service names

Query a passive DNS database for historical DNS records associated with the ASN

GIAC Cloud Penetration Tester

Domain 2Objective 1

Discovering Cloud Services and Data GCPN Practice Questions (Page 6)

Part of the Cloud Service Discovery and Reconnaissance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 26–30

26application · medium
During a cloud penetration test, you discover that a target organization uses AWS S3 buckets for backups. You find a bucket name 'acme-backup-2023' via a public GitHub repository. You attempt to list the bucket and receive an 'AccessDenied' error. What is the most likely reason for this error, and what should you do next?
Select an answer first
27foundation · easy
What is the goal of cloud API reconnaissance?
Select an answer first
28foundation · easy
Which HTTP status code typically indicates that an AWS S3 bucket is publicly listable?
Select an answer first
29application · medium
A security analyst is investigating a suspicious IP address that is communicating with a target's network. The analyst wants to determine if the IP belongs to a cloud provider and which region it is in. Which of the following is the most reliable method?
Select an answer first
30application · medium
During a cloud assessment, you are asked to enumerate the cloud services used by a target organization. You have the organization's ASN and permission to perform passive reconnaissance. Which technique is most effective for identifying cloud services hosted on that ASN?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Discovering Cloud Services and Data GCPN Practice Questions (Page 6)

Questions 26–30

What is the goal of cloud API reconnaissance?

Which HTTP status code typically indicates that an AWS S3 bucket is publicly listable?

A security analyst is investigating a suspicious IP address that is communicating with a target's network. The analyst wants to determine if the IP belongs to a cloud provider and which region it is in. Which of the following is the most reliable method?

During a cloud assessment, you are asked to enumerate the cloud services used by a target organization. You have the organization's ASN and permission to perform passive reconnaissance. Which technique is most effective for identifying cloud services hosted on that ASN?

Keep studying — Cloud Service Discovery and Reconnaissance