You have compromised a web application running on an AWS EC2 instance. The instance has an IAM role attached. You want to extract the temporary credentials from the instance metadata service, but you discover that the metadata service is configured with IMDSv2 and requires a token. Which sequence of commands is correct?

`TOKEN=$(curl -X PUT 'http://169.254.169.254/latest/api/token' -H 'X-aws-ec2-metadata-token-ttl-seconds: 21600')` then `curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/`

`curl -X POST 'http://169.254.169.254/latest/api/token' -H 'X-aws-ec2-metadata-token-ttl-seconds: 21600'`

`curl http://169.254.169.254/latest/meta-data/iam/security-credentials/` without any token

`curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ -H 'X-aws-ec2-metadata-token: 12345'`

You are performing passive reconnaissance on a target organization. You have found a public code repository that contains a configuration file with an AWS access key ID and secret access key. You want to determine whether the key is still valid without making any requests to AWS. Which approach is most appropriate?

Use the AWS CLI to call `sts:GetCallerIdentity` with the key

Check the age of the key by searching for the access key ID in public breach databases or GitHub history

Assume the key is invalid because it was found in a public repository

Use a tool like `aws-key-disabler` to test the key

What type of information can be discovered by mining public code repositories for cloud assets?

The target's physical office security camera feeds

Hardcoded API keys and cloud storage bucket names

The target's customer credit card numbers

The target's internal employee salaries

A cloud security team wants to identify all publicly exposed Azure resources belonging to their organization. They have a list of domain names and want to use public information to enumerate resources. Which approach is most effective?

Search certificate transparency logs for '*.azurewebsites.net' and '*.blob.core.windows.net' entries

Perform a reverse IP lookup on Azure IP ranges to find associated domains

Use the Azure CLI to run 'az resource list' for each domain

Query the Azure REST API for each domain to list all resources

A penetration tester is assessing a target's AWS environment. They find an S3 bucket that allows 's3:GetObject' for the 'AllUsers' group but denies 's3:ListBucket'. The tester knows a common object name pattern. Which of the following is the most effective way to determine if the bucket is misconfigured and access data?

Use a tool like 'bucket-stream' to brute-force common object names

Use the S3 API to request a pre-signed URL for the bucket

Check the bucket's ACL to see if the 'AllUsers' group has write permission

Attempt to list the bucket using the AWS CLI with the '--no-sign-request' flag

GIAC Cloud Penetration Tester

Domain 2Objective 1

Discovering Cloud Services and Data GCPN Practice Questions (Page 7)

Part of the Cloud Service Discovery and Reconnaissance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 31–35

31expert · hard
You have compromised a web application running on an AWS EC2 instance. The instance has an IAM role attached. You want to extract the temporary credentials from the instance metadata service, but you discover that the metadata service is configured with IMDSv2 and requires a token. Which sequence of commands is correct?
Select an answer first
32application · medium
You are performing passive reconnaissance on a target organization. You have found a public code repository that contains a configuration file with an AWS access key ID and secret access key. You want to determine whether the key is still valid without making any requests to AWS. Which approach is most appropriate?
Select an answer first
33foundation · easy
What type of information can be discovered by mining public code repositories for cloud assets?
Select an answer first
34application · medium
A cloud security team wants to identify all publicly exposed Azure resources belonging to their organization. They have a list of domain names and want to use public information to enumerate resources. Which approach is most effective?
Select an answer first
35expert · hard
A penetration tester is assessing a target's AWS environment. They find an S3 bucket that allows 's3:GetObject' for the 'AllUsers' group but denies 's3:ListBucket'. The tester knows a common object name pattern. Which of the following is the most effective way to determine if the bucket is misconfigured and access data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Discovering Cloud Services and Data GCPN Practice Questions (Page 7)

Questions 31–35

What type of information can be discovered by mining public code repositories for cloud assets?

A cloud security team wants to identify all publicly exposed Azure resources belonging to their organization. They have a list of domain names and want to use public information to enumerate resources. Which approach is most effective?

Keep studying — Cloud Service Discovery and Reconnaissance