A red team operator has compromised a cloud environment and wants to maintain persistence while avoiding detection. The environment has centralized logging and alerting, and the security team monitors for unusual IAM activity. The operator has access to a service account with permissions to create and manage IAM roles. Which persistence technique is most likely to avoid detection?

Adding a new access key to the compromised service account and using it for all future access.

Modifying the trust policy of an existing role to allow the compromised service account to assume it.

Creating a new user with administrative privileges and using it for all future access.

Creating a new IAM role that trusts the compromised service account and attaching a policy that allows it to assume any role.

During a cloud red team engagement, the team is building a threat model for a company that uses AWS with a mix of EC2 instances, S3 buckets, and Lambda functions. The company's primary concern is data exfiltration. Which combination of threats should be prioritized in the threat model?

DDoS attacks on the EC2 instances and network saturation.

Physical theft of laptops from the development team.

Misconfigured S3 bucket permissions and overly permissive IAM roles that allow broad data access.

SQL injection in a legacy web application hosted on EC2.

During a red team engagement, you are performing reconnaissance on an Azure environment. You have identified a public IP address that hosts a web application. You want to discover Azure resources that are not directly exposed but may be accessible via misconfigurations. Which technique is most effective?

Use the Azure CLI to list all resources in the subscription.

Search for the company's Azure AD tenant ID in public breach databases.

Perform a full port scan on the public IP to identify all open ports.

Enumerate Azure DNS names for the domain and look for subdomains pointing to Azure services.

You are enumerating an AWS environment and discover an S3 bucket that is configured to allow public read access. The bucket contains what appears to be a database backup. The engagement scope allows testing data exfiltration. Which action is most appropriate?

Delete the backup file to prevent further exposure.

Use the bucket's access logs to identify other users who accessed it.

Download the backup file and analyze it for sensitive data.

Attempt to write a test file to the bucket to check for write access.

What is the primary difference between passive and active reconnaissance?

Passive reconnaissance does not directly interact with the target, while active reconnaissance does

Passive reconnaissance is used only for cloud, while active is for on-premises

Active reconnaissance is always illegal, while passive is legal

Active reconnaissance is faster than passive

GIAC Cloud Penetration Tester

Domain 1Objective 2

Red Team Penetration Testing of Cloud Environments GCPN Practice Questions (Page 7)

Part of the Cloud Penetration Testing Fundamentals domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 4–7 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

11concepts

Questions 31–35

31expert · hard
A red team operator has compromised a cloud environment and wants to maintain persistence while avoiding detection. The environment has centralized logging and alerting, and the security team monitors for unusual IAM activity. The operator has access to a service account with permissions to create and manage IAM roles. Which persistence technique is most likely to avoid detection?
Select an answer first
32application · medium
During a cloud red team engagement, the team is building a threat model for a company that uses AWS with a mix of EC2 instances, S3 buckets, and Lambda functions. The company's primary concern is data exfiltration. Which combination of threats should be prioritized in the threat model?
Select an answer first
33expert · hard
During a red team engagement, you are performing reconnaissance on an Azure environment. You have identified a public IP address that hosts a web application. You want to discover Azure resources that are not directly exposed but may be accessible via misconfigurations. Which technique is most effective?
Select an answer first
34expert · hard
You are enumerating an AWS environment and discover an S3 bucket that is configured to allow public read access. The bucket contains what appears to be a database backup. The engagement scope allows testing data exfiltration. Which action is most appropriate?
Select an answer first
35foundation · easy
What is the primary difference between passive and active reconnaissance?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.

Red Team Penetration Testing of Cloud Environments GCPN Practice Questions (Page 7)

Questions 31–35

During a cloud red team engagement, the team is building a threat model for a company that uses AWS with a mix of EC2 instances, S3 buckets, and Lambda functions. The company's primary concern is data exfiltration. Which combination of threats should be prioritized in the threat model?

You are enumerating an AWS environment and discover an S3 bucket that is configured to allow public read access. The bucket contains what appears to be a database backup. The engagement scope allows testing data exfiltration. Which action is most appropriate?

What is the primary difference between passive and active reconnaissance?

Keep studying — Cloud Penetration Testing Fundamentals