A red teamer is performing reconnaissance on a target Azure environment. The team has only the company's domain name and a list of public IP addresses. Which technique would be most effective for discovering Azure-specific resources and potential entry points?

Attempt to brute-force Azure AD user accounts using the company's domain.

Use Shodan to search for Azure IP ranges and identify exposed management interfaces.

Perform a full TCP port scan of all public IP addresses to identify open ports and services.

Query Azure-specific DNS records and search for storage accounts, app services, and other Azure resources in public DNS.

A red team engagement has concluded, and the team is preparing the final report. The client has requested that the report include a risk rating for each finding. The team found a publicly accessible storage bucket containing customer data. The client's security team has stated that the bucket was intentionally made public for a marketing campaign. Which risk rating is most appropriate for this finding?

Informational, because the bucket was intentionally made public and the client is aware of it.

Low, because the bucket was intentionally made public for a legitimate business purpose.

Medium, because the bucket is public but the data may not be sensitive.

High, because the bucket contains customer data and is publicly accessible, regardless of the intended purpose.

During a red team engagement, you have compromised an EC2 instance in a private subnet. The instance has a security group that allows outbound internet access. You need to exfiltrate data to an external server you control. Which technique is most likely to succeed while evading common network monitoring?

Use HTTP POST requests to a public pastebin service.

Use the AWS CLI to copy data to an S3 bucket in your account.

Use raw TCP sockets to connect to your server on port 443.

Use DNS tunneling to encode data in DNS queries to a domain you control.

Which misconfiguration is commonly tested in cloud storage services?

Publicly accessible storage buckets

GIAC Cloud Penetration Tester

Domain 1Objective 2

Red Team Penetration Testing of Cloud Environments GCPN Practice Questions (Page 1)

Part of the Cloud Penetration Testing Fundamentals domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 4–7 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

11concepts

Questions 1–5

1application · medium
A red teamer is performing reconnaissance on a target Azure environment. The team has only the company's domain name and a list of public IP addresses. Which technique would be most effective for discovering Azure-specific resources and potential entry points?
Select an answer first
2foundation · easy
Which attack targets weaknesses in cloud identity and access management?
Select an answer first
3expert · hard
A red team engagement has concluded, and the team is preparing the final report. The client has requested that the report include a risk rating for each finding. The team found a publicly accessible storage bucket containing customer data. The client's security team has stated that the bucket was intentionally made public for a marketing campaign. Which risk rating is most appropriate for this finding?
Select an answer first
4application · medium
During a red team engagement, you have compromised an EC2 instance in a private subnet. The instance has a security group that allows outbound internet access. You need to exfiltrate data to an external server you control. Which technique is most likely to succeed while evading common network monitoring?
Select an answer first
5foundation · easy
Which misconfiguration is commonly tested in cloud storage services?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Red Team Penetration Testing of Cloud Environments GCPN Practice Questions (Page 1)

Questions 1–5

A red teamer is performing reconnaissance on a target Azure environment. The team has only the company's domain name and a list of public IP addresses. Which technique would be most effective for discovering Azure-specific resources and potential entry points?

Which attack targets weaknesses in cloud identity and access management?

Which misconfiguration is commonly tested in cloud storage services?

Keep studying — Cloud Penetration Testing Fundamentals