What is a primary attack vector for serverless functions?

Network sniffing on the local network

Injection flaws in function code

Brute-forcing the root password

What is the purpose of a security group in a cloud network?

To control inbound and outbound traffic to cloud resources

Which technique is commonly used to evade detection in cloud environments?

Implementing multi-factor authentication

Using strong encryption for data at rest

Clearing or tampering with audit logs

A red teamer has compromised an Azure VM and wants to maintain access while evading detection by Azure Sentinel. The VM has the Azure Monitor agent installed and sends logs to a Log Analytics workspace. Which technique is most effective for evading detection?

Modify the VM's diagnostic settings to send logs to a different workspace.

Use a PowerShell script to clear the event logs on the VM.

Create a scheduled task that periodically disables the Azure Monitor agent and re-enables it after a short time.

Stop the Azure Monitor agent service on the VM.

A red team engagement is being planned for a multi-account cloud environment. The client has specified that the engagement must not disrupt production workloads, must avoid any activity that could trigger a denial-of-service condition, and must include a detailed report of all actions taken. The red team lead is defining the rules of engagement. Which action is most appropriate?

Delegate all rule-of-engagement decisions to the individual red team operators based on their judgment during the engagement.

Allow all cloud-native attack techniques as long as the team cleans up any artifacts before the engagement ends.

Require the team to use only passive reconnaissance and manual testing to guarantee no impact on production.

Include a list of authorized IP ranges and time windows, and explicitly prohibit load testing or resource exhaustion attempts.

GIAC Cloud Penetration Tester

Domain 1Objective 2

Red Team Penetration Testing of Cloud Environments GCPN Practice Questions (Page 3)

Part of the Cloud Penetration Testing Fundamentals domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 4–7 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

11concepts

Questions 11–15

11foundation · easy
What is a primary attack vector for serverless functions?
Select an answer first
12foundation · easy
What is the purpose of a security group in a cloud network?
Select an answer first
13foundation · easy
Which technique is commonly used to evade detection in cloud environments?
Select an answer first
14expert · hard
A red teamer has compromised an Azure VM and wants to maintain access while evading detection by Azure Sentinel. The VM has the Azure Monitor agent installed and sends logs to a Log Analytics workspace. Which technique is most effective for evading detection?
Select an answer first
15application · medium
A red team engagement is being planned for a multi-account cloud environment. The client has specified that the engagement must not disrupt production workloads, must avoid any activity that could trigger a denial-of-service condition, and must include a detailed report of all actions taken. The red team lead is defining the rules of engagement. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.