Red Team Penetration Testing of Cloud Environments GCPN Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A red team operator is attempting to intercept traffic between two VMs in a cloud environment. The VMs are in the same VPC and communicate over a private network. The operator has compromised one of the VMs and has administrative privileges on it. The environment uses flow logs and network monitoring. Which technique is most effective for intercepting traffic while minimizing detection?

   • AUsing ARP spoofing on the compromised VM to redirect traffic from the other VM through the compromised VM.
   • BEnabling VPC traffic mirroring on the compromised VM's network interface to send a copy of traffic to a controlled instance.
   • CUsing the cloud provider's API to attach a new network interface to the compromised VM and enable promiscuous mode.
   • DConfiguring the compromised VM's security group to allow traffic from the other VM and using tcpdump to capture it.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a cloud-specific threat that should be considered during threat modeling?

   • APhysical theft of a laptop
   • BSQL injection in a web application
   • CMan-in-the-middle attack on a local network
   • DInsecure APIs and interfaces
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   At the end of a cloud red team engagement, you need to report a critical finding about a publicly accessible S3 bucket containing customer data. Which reporting approach is most effective for driving remediation?

   • ARecommend that the client migrate to a different cloud provider.
   • BProvide the exact bucket name, the risk of data exposure, and step-by-step remediation instructions to block public access.
   • CInclude a proof-of-concept script that downloads all customer data.
   • DOnly mention the finding in the executive summary without technical details.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A red team operator is attempting to pivot from a compromised VM to an internal database server. The VM has a public IP and is in a VPC with a security group that only allows inbound traffic on port 22 from the operator's IP. The database server is in a private subnet and is only accessible from the VPC. Which technique is most effective for pivoting?

   • AUsing the compromised VM as a jump host and SSH tunneling to the database server.
   • BModifying the security group of the database server to allow inbound traffic from the operator's IP.
   • CUsing a public load balancer to forward traffic to the database server.
   • DCreating a new VM in the same VPC and using it as a proxy.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A red team operator has obtained a set of valid credentials for a low-privileged user in a cloud environment. The operator wants to escalate privileges to gain administrative access. The environment uses role-based access control (RBAC) with custom roles. Which technique is most likely to succeed?

   • AExploiting a vulnerability in a public-facing web application to gain a reverse shell.
   • BUsing the current credentials to access the cloud provider's support portal and request a password reset.
   • CEnumerating all roles and policies the current user can access, then looking for roles with permissions to modify IAM policies.
   • DAttempting to brute-force the password of an administrative user.
   Reveal Solution Discussion Select an answer first