Certified Ethical Hacker Cloud Security and Penetration Testing 2 — Questions and Answers
Question 1: Which attack targets the cloud management plane to gain administrative control over an entire cloud environment?
- SSRF
- Hypervisor Attack
- Container Escape
- Wrapping Attack (Correct answer)
Correct answer: Wrapping Attack
A wrapping attack (XML Signature Wrapping) manipulates SOAP messages to the cloud management API, potentially granting attacker admin access.
Question 2: What is the primary purpose of a Cloud Access Security Broker (CASB)?
- To replace firewalls in cloud environments
- To enforce security policies between cloud users and providers (Correct answer)
- To encrypt all data stored in the cloud
- To perform penetration testing on cloud services
Correct answer: To enforce security policies between cloud users and providers
A CASB acts as an intermediary between cloud users and providers to enforce security policies such as DLP, access control, and threat protection.
Question 3: During a cloud penetration test, an attacker discovers an EC2 instance metadata endpoint at 169.254.169.254. What is the risk?
- Remote code execution on the host
- Exposure of IAM credentials via SSRF (Correct answer)
- DNS hijacking
- Cross-tenant data access
Correct answer: Exposure of IAM credentials via SSRF
The EC2 instance metadata endpoint can expose temporary IAM role credentials when accessed via SSRF, allowing privilege escalation in AWS.
Question 4: Which tool is commonly used to test for misconfigured AWS S3 bucket permissions?
- Gobuster
- S3Scanner (Correct answer)
- Hydra
- Maltego
Correct answer: S3Scanner
S3Scanner enumerates and checks the permissions of Amazon S3 buckets to identify publicly accessible or misconfigured buckets.
Question 5: What does the shared responsibility model in cloud security define?
- How costs are split between provider and customer
- Which security tasks belong to the provider versus the customer (Correct answer)
- The SLA for cloud uptime guarantees
- How data is replicated across regions
Correct answer: Which security tasks belong to the provider versus the customer
The shared responsibility model delineates which security controls are managed by the cloud provider and which are the customer's responsibility.
Question 6: Which container escape technique exploits a misconfigured Docker socket mounted inside a container?
- Kernel exploit
- Privileged container breakout
- Docker socket abuse (Correct answer)
- Namespace pivot
Correct answer: Docker socket abuse
Mounting the Docker socket (/var/run/docker.sock) inside a container allows an attacker to control the host Docker daemon and escape the container.
Certified Ethical Hacker Cloud Security and Penetration Testing 2
Which attack targets the cloud management plane to gain administrative control over an entire cloud environment?