You are threat modeling a multi-tier application in AWS. The application uses an Application Load Balancer (ALB) in front of EC2 instances in a private subnet, and an RDS database in a separate private subnet. The team is concerned about both external attackers and insider threats. Which threat should be prioritized as the highest risk?

A misconfigured security group allowing inbound SSH from the internet to the EC2 instances.

An external attacker exploiting a misconfigured ALB to access internal EC2 instances directly.

An insider with read-only access to the RDS database using that access to exfiltrate sensitive data.

An external attacker performing a DDoS attack on the ALB.

What is a common technique used to escalate privileges in a cloud environment?

Exploiting overly permissive IAM roles

In a cloud red team engagement, which activity is typically performed during the initial planning phase?

Exploiting a known vulnerability in a public-facing web application

Reviewing cloud provider audit logs to identify misconfigurations

Deploying a backdoor to maintain persistent access

Defining the rules of engagement and scope boundaries

What is the primary objective of a red team penetration test in a cloud environment?

To identify as many vulnerabilities as possible in a short time

To simulate a real-world adversary's tactics, techniques, and procedures to test the organization's defenses

To patch all identified security issues during the engagement

To ensure compliance with industry regulations

Which of the following is an example of cloud service enumeration?

Listing accessible storage buckets in a cloud account

Exploiting a buffer overflow in a web server

Sending a phishing email to an employee

GIAC Cloud Penetration Tester

Domain 1Objective 2

Red Team Penetration Testing of Cloud Environments GCPN Practice Questions (Page 8)

Part of the Cloud Penetration Testing Fundamentals domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 4–7 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

11concepts

Questions 36–40

36expert · hard
You are threat modeling a multi-tier application in AWS. The application uses an Application Load Balancer (ALB) in front of EC2 instances in a private subnet, and an RDS database in a separate private subnet. The team is concerned about both external attackers and insider threats. Which threat should be prioritized as the highest risk?
Select an answer first
37foundation · easy
What is a common technique used to escalate privileges in a cloud environment?
Select an answer first
38foundation · easy
In a cloud red team engagement, which activity is typically performed during the initial planning phase?
Select an answer first
39foundation · easy
What is the primary objective of a red team penetration test in a cloud environment?
Select an answer first
40foundation · easy
Which of the following is an example of cloud service enumeration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.