Which of the following is an example of a persistence technique in a cloud environment?

Creating a new IAM user with administrative privileges

Changing the security group rules to block all traffic

What is a common method to simulate data exfiltration from cloud storage?

Changing the bucket's permissions

Uploading a malicious file to the bucket

Deleting all objects in the bucket

Downloading a large amount of data from a misconfigured bucket

When prioritizing cloud-specific threats, which factor is most important to consider?

The cost of the cloud subscription

The geographic location of the cloud provider's data centers

The likelihood of the threat occurring and the potential impact on the organization

The number of cloud services in use

During a cloud red team engagement, the operator has discovered an internal load balancer that is accessible from the internet due to a misconfigured security group. The operator wants to enumerate the backend services behind the load balancer. Which technique is most effective for this purpose?

Querying the cloud provider's API for load balancer configuration details.

Using a DNS brute-force tool to discover subdomains pointing to the load balancer.

Sending HTTP requests with different Host headers to the load balancer's public IP.

Performing a full TCP port scan on the load balancer's public IP.

GIAC Cloud Penetration Tester

Domain 1Objective 2

Red Team Penetration Testing of Cloud Environments GCPN Practice Questions (Page 9)

Part of the Cloud Penetration Testing Fundamentals domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 4–7 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

11concepts

Questions 41–45

41foundation · easy
Which of the following is an example of a persistence technique in a cloud environment?
Select an answer first
42foundation · easy
What is a common method to simulate data exfiltration from cloud storage?
Select an answer first
43foundation · easy
When prioritizing cloud-specific threats, which factor is most important to consider?
Select an answer first
44foundation · easy
Which cloud network component can be misconfigured to allow unauthorized traffic interception?
Select an answer first
45application · medium
During a cloud red team engagement, the operator has discovered an internal load balancer that is accessible from the internet due to a misconfigured security group. The operator wants to enumerate the backend services behind the load balancer. Which technique is most effective for this purpose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCPN” is a trademark of its owner, used for identification only.