Red Team Penetration Testing of Cloud Environments GCPN Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A red teamer has obtained a set of valid AWS access keys for a low-privileged IAM user. The engagement scope allows testing privilege escalation. Which technique is most appropriate to attempt first?

   • AImmediately attempt to create a new IAM admin user.
   • BTry to access the AWS Management Console using the access keys.
   • CEnumerate the IAM user's permissions and check for policies that allow iam:PassRole or iam:CreatePolicyVersion.
   • DUse the keys to launch a new EC2 instance with a user-data script that adds the user to the admin group.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During the planning phase of a cloud red team engagement, the team is identifying high-value targets. The client's environment includes a public-facing web application, a customer database in a managed database service, and a CI/CD pipeline with secrets stored in a cloud secrets manager. The team wants to prioritize targets that could lead to broad compromise. Which target should be considered the highest priority?

   • AThe public-facing web application, because it is the most exposed asset and likely has the largest attack surface.
   • BThe cloud network configuration, because controlling the network allows interception of all traffic.
   • CThe customer database, because it contains sensitive data that is the ultimate target for data exfiltration.
   • DThe CI/CD pipeline secrets manager, because it may contain credentials that grant access to multiple cloud services.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A red team engagement is being planned against a multi-cloud environment (AWS and Azure). The client has approved testing of production workloads but explicitly excluded any activity that could disrupt the payment processing service. During the reconnaissance phase, the team identifies a public S3 bucket that appears to contain configuration files. Which action best aligns with the engagement scope and rules of engagement?

   • AAttempt to upload a test file to the S3 bucket to verify write permissions.
   • BRun a full port scan of the payment service's public IP range to map its attack surface.
   • CDownload the configuration files and analyze them for credentials or sensitive data.
   • DEnumerate IAM roles and policies in the AWS account to identify privilege escalation paths.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Why is it important to understand cloud logging capabilities during a red team engagement?

   • ATo configure logging for the cloud environment
   • BTo identify which actions may be logged and avoid detection
   • CTo ensure compliance with logging regulations
   • DTo delete all logs after the engagement
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   After compromising an AWS account, you want to establish persistence that survives a password reset and is less likely to be detected. Which method is most effective?

   • ACreate a new IAM user with programmatic access and attach an administrator policy.
   • BCreate an access key for an existing IAM user that is not regularly used.
   • CModify the password policy to allow weaker passwords.
   • DCreate a new AWS account and use cross-account roles.
   Reveal Solution Discussion Select an answer first