During a cloud assessment, you are asked to identify all cloud services used by a target organization. You have the organization's main domain and permission to perform passive reconnaissance. Which combination of techniques is most effective for discovering cloud services without sending active requests to the target?

Use a cloud enumeration tool to brute-force common service names against the domain

Search the organization's public GitHub repositories for cloud configuration files

Perform a full port scan of the organization's IP ranges

Query certificate transparency logs and DNS records for cloud provider-specific subdomains

What is the primary purpose of cloud storage bucket discovery during a penetration test?

To measure the performance and latency of the storage service

To identify publicly accessible storage buckets and assess whether they expose sensitive data

To determine the physical location of the data center hosting the buckets

To enumerate all IAM users who have access to the buckets

You have obtained a shell on a web application running inside an AWS EC2 instance. The application uses an IAM role attached to the instance. You need to retrieve temporary credentials to access S3 buckets in the same account, but you want to avoid triggering AWS CloudTrail alerts that monitor for `sts:AssumeRole` calls. Which action is most likely to achieve this?

Use the EC2 instance's user data script to print environment variables

Query the instance metadata service at `http://169.254.169.254/latest/meta-data/iam/security-credentials/` and then the role name

Read the AWS credentials file from the instance's home directory

Call `sts:AssumeRole` with the instance role's ARN to get a new set of credentials

You are assessing a client's AWS environment. You have discovered an S3 bucket that is publicly listable, but the objects are encrypted with AWS KMS. You want to determine whether the objects are accessible to unauthenticated users. Which factor is most important?

The bucket policy must grant `s3:GetObject` to `*` and the KMS key policy must grant `kms:Decrypt` to `*`

The objects must be encrypted with SSE-S3 instead of SSE-KMS

The bucket must be in the same region as the KMS key

The bucket must have versioning enabled

During a penetration test, you find an SSRF vulnerability in a web application hosted on an Azure VM. You attempt to access the Azure Instance Metadata Service (IMDS) at 'http://169.254.169.254/metadata/instance?api-version=2021-02-01' but receive a 400 error. What is the most likely cause, and how should you proceed?

The request is missing the 'Metadata: true' header; add the header to the request

The IMDS endpoint is blocked by a network security group; try using a different IP address

The API version is incorrect; use a newer version like '2021-02-01'

The VM does not have a managed identity; you need to create one first

GIAC Cloud Penetration Tester

Domain 2Objective 1

Discovering Cloud Services and Data GCPN Practice Questions (Page 8)

Part of the Cloud Service Discovery and Reconnaissance domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 36–40

36application · medium
During a cloud assessment, you are asked to identify all cloud services used by a target organization. You have the organization's main domain and permission to perform passive reconnaissance. Which combination of techniques is most effective for discovering cloud services without sending active requests to the target?
Select an answer first
37foundation · easy
What is the primary purpose of cloud storage bucket discovery during a penetration test?
Select an answer first
38expert · hard
You have obtained a shell on a web application running inside an AWS EC2 instance. The application uses an IAM role attached to the instance. You need to retrieve temporary credentials to access S3 buckets in the same account, but you want to avoid triggering AWS CloudTrail alerts that monitor for `sts:AssumeRole` calls. Which action is most likely to achieve this?
Select an answer first
39expert · hard
You are assessing a client's AWS environment. You have discovered an S3 bucket that is publicly listable, but the objects are encrypted with AWS KMS. You want to determine whether the objects are accessible to unauthenticated users. Which factor is most important?
Select an answer first
40expert · hard
During a penetration test, you find an SSRF vulnerability in a web application hosted on an Azure VM. You attempt to access the Azure Instance Metadata Service (IMDS) at 'http://169.254.169.254/metadata/instance?api-version=2021-02-01' but receive a 400 error. What is the most likely cause, and how should you proceed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Discovering Cloud Services and Data GCPN Practice Questions (Page 8)

Questions 36–40

What is the primary purpose of cloud storage bucket discovery during a penetration test?

You are assessing a client's AWS environment. You have discovered an S3 bucket that is publicly listable, but the objects are encrypted with AWS KMS. You want to determine whether the objects are accessible to unauthenticated users. Which factor is most important?

Keep studying — Cloud Service Discovery and Reconnaissance