Certified Ethical Hacker Cloud Security and Penetration Testing 3

Question 1

What is 'cloud hopping' in the context of CEH?

Accepted Answer

Using one compromised cloud account to attack another

Answer

Cloud hopping is an attack where a threat actor compromises one cloud account or tenant and uses it as a pivot point to attack other cloud accounts.

Question 2

Which AWS service, if misconfigured, can expose all stored objects to the public internet?

Accepted Answer

S3 Bucket ACLs

Answer

Misconfigured S3 bucket ACLs or bucket policies can make all stored objects publicly readable, leading to data exposure.

Question 3

During cloud pen testing, what does 'privilege escalation via IAM misconfiguration' typically involve?

Accepted Answer

Attaching higher-privilege policies to a compromised IAM entity

Answer

IAM privilege escalation involves using permissions like iam:AttachUserPolicy or iam:PassRole to grant a compromised identity elevated cloud privileges.

Question 4

What is the purpose of AWS CloudTrail in a security context?

Accepted Answer

Logging API calls and user activity for auditing

Answer

AWS CloudTrail records API calls and management events across an AWS account, providing an audit trail for security analysis and compliance.

Question 5

Which type of cloud attack involves injecting malicious content into a cloud service to be executed by other users or services?

Accepted Answer

Cross-Cloud Scripting (XCS)

Answer

Cross-Cloud Scripting (XCS) is similar to XSS but targets cloud-hosted applications, injecting malicious scripts that execute in the context of other cloud users.

Certified Ethical Hacker Practice Test

Certified Ethical Hacker Practice Test

Certified Ethical Hacker Cloud Security and Penetration Testing 3