You must analyze real cloud and container configurations, trace how misconfigurations chain into host or tenant compromise, and distinguish genuine deficiencies from noise. The single most important skill is mapping an observed weakness to the exact privilege or data it actually grants an attacker.
Start practicing
Cloud And Hybrid Infrastructure Security — choose a session length
Free · No account required
Domain overview
This domain covers securing and attacking cloud and hybrid estates: AWS, Azure, and GCP logging and monitoring gaps, container runtime weaknesses, Kubernetes misconfigurations, and identity abuse. CPENT tests it through scenario questions where you analyze configurations, trace privilege escalation paths, and identify which weaknesses actually enable compromise rather than merely looking suspicious.
Exam objectives
Spotting deficient cloud logging: missing CloudTrail, Activity Log, or VPC flow log coverage
Exploiting container capabilities like CAP_SYS_ADMIN and cgroup v1 release_agent for host escape
Abusing Azure App Service Managed Identity via SSRF to reach the Instance Metadata Service token endpoint
Identifying Kubernetes misconfigurations: privileged pods, hostPath mounts, hostNetwork, and over-permissive RBAC
Treating any enabled logging as sufficient; auditors look for gaps in coverage, retention, and alerting across accounts and subscriptions.
Assuming a container shell alone means host compromise; escape requires specific capabilities, mounts, or kernel weaknesses.
Confusing Managed Identity token theft with credential dumping; the SSRF reaches IMDS, not the local disk or registry.
Click any question to see the full explanation and answer options, or start a focused practice session above.
An auditor finds an Amazon S3 bucket configured with public read access enabled via an Access Control List (ACL), but the bucket policy explicitly denies public read access. How does AWS evaluate these conflicting permissions?
2A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?
3A penetration tester is evaluating an AWS environment and discovers that an IAM role attached to an Amazon EC2 instance has an overly permissive trust policy allowing any user in the account to assume it via the sts:AssumeRole API without external conditions. Which specific remediation step should the cloud administrator apply to fix this risk?
4In a hybrid enterprise environment, an organization uses Azure AD Seamless Single Sign-On (Seamless SSO). During a penetration test, an attacker compromises a domain-joined workstation and attempts to abuse Seamless SSO. What is the mechanism by which Seamless SSO authenticates users, and what is a known security consideration?
5An auditor reviews an Azure storage account and notes that 'Secure transfer required' is set to Disabled. What security risk does this misconfiguration introduce?
6During an assessment of a Google Cloud Platform (GCP) environment, a penetration tester finds a Compute Engine instance with default service account credentials and scopes set to https://www.googleapis.com/auth/cloud-platform. What security implication does this broad scope present?
7A security engineer discovers that an AWS IAM user has an active access key and permissions to run ec2:RunInstances, iam:PassRole, and iam:CreateRole. What privilege escalation path does this permission combination represent?
8An AWS penetration tester discovers that an Amazon RDS database instance has the 'Publicly Accessible' flag set to true, and its security group allows inbound traffic from 0.0.0.0/0 on port 3306. What is the immediate risk, and what is the recommended control?
9A penetration tester is analyzing a Kubernetes deployment where a ClusterRole grants the verbs get, list, and watch on secrets, combined with a ClusterRoleBinding assigning this to a default service account in a public-facing namespace. How can an external attacker exploit this configuration?
10During an Azure assessment, an attacker discovers that an App Service web application has Managed Identity enabled and the underlying application code is vulnerable to Server-Side Request Forgery (SSRF). How can the attacker chain these vulnerabilities?
11An administrator needs to secure communication between microservices running across different AWS Virtual Private Clouds (VPCs). Which native AWS networking feature provides private connectivity without exposing traffic to the public internet?
12A penetration tester is evaluating a Kubernetes cluster utilizing Role-Based Access Control (RBAC) and notes that a custom role has the create verb on pods/exec resources. What security risk does this specific permission entail?
13An attacker gains access to an Azure environment and enumerates App Service Configuration settings. They discover that connection strings and database passwords are stored in plaintext within the application settings rather than being referenced via Azure Key Vault references. What attack path does this enable?
14During an AWS penetration test, the tester finds an Amazon API Gateway REST API configured with an AWS_IAM authorizer, but one specific method is mistakenly set to 'Authorization: None' (Open API method). What security risk does this introduce?
15An auditor identifies that an organization's Azure storage account allows anonymous public read access to containers and blobs. What configuration change must be applied to remediate this finding?
16A penetration tester is evaluating a hybrid Active Directory environment. They compromise an on-premises user account that has been synchronized to Azure AD. They discover that the on-premises account is a member of a high-privilege local group, but Azure AD Connect has filtered out this group synchronization. How can the tester leverage Azure AD Connect configuration weaknesses?
17A penetration tester is assessing an AWS environment where an EC2 instance is associated with an IAM role that trusts an external third-party AWS account in its trust policy, but the external account ID was mistyped or left overly broad (e.g., condition missing external ID or using an insecure principal). What vulnerability does this introduce?
18An AWS penetration tester uncovers an IAM policy attached to a user that contains the action 'iam:PutUserPolicy' with a resource of '*'. What privilege escalation vector does this enable?
19An auditor is reviewing an Azure Kubernetes Service (AKS) cluster and discovers that Role-Based Access Control (RBAC) was disabled during cluster creation, and Azure Active Directory integration is not enabled. What is the primary security consequence?
20During an assessment of a Google Cloud Platform project, a penetration tester finds that a Cloud Storage bucket has the allUsers principal granted the Storage Object Viewer role. What security flaw does this represent, and how should it be fixed?
21An Azure penetration tester identifies a Virtual Machine with public IP access that has an incoming Network Security Group (NSG) rule allowing TCP port 3389 (RDP) from any source ('Any' or 'Internet'). What is the recommended remediation?
22A penetration tester is analyzing a Kubernetes cluster where pods utilize service accounts with automountServiceAccountToken set to true globally or on sensitive pods. The tester gains remote code execution inside a pod running with a high-privilege service account token. How can they use this token against the Kubernetes API?
23During an Azure penetration test, an attacker identifies an Azure Function with an HTTP trigger that uses function-level keys. However, the function key was leaked in a public GitHub repository. What level of access does this key provide?
24A penetration tester is evaluating a Kubernetes environment and discovers that the Kubernetes dashboard is deployed with cluster-admin privileges and is exposed to the internet via a NodePort service without authentication. How can this be exploited?
25An auditor is reviewing an AWS cloud environment and identifies several common misconfigurations related to identity and access management. Which TWO of the following practices represent significant security risks? (Choose TWO)
26During a penetration test of an Azure Active Directory tenant, an attacker identifies multiple security misconfigurations. Which TWO of the following techniques represent common Azure AD attack vectors or misconfigurations? (Choose TWO)
27An auditor is evaluating cloud storage security across multiple cloud providers. Which TWO of the following settings indicate improper security configurations for cloud storage buckets? (Choose TWO)
28During an Azure subscription review, a security assessor checks for role-based access control and resource configuration best practices. Which TWO of the following findings represent high-severity security risks? (Choose TWO)
29An auditor reviews network security configurations in an AWS VPC. Which TWO of the following network configurations represent potential security risks? (Choose TWO)
30An auditor reviews cloud logging and monitoring configurations across an enterprise multi-cloud environment. Which TWO of the following practices represent critical security deficiencies? (Choose TWO)
31During a Kubernetes cluster security assessment, a penetration tester identifies multiple misconfigurations. Which TWO of the following findings represent high-risk security flaws in Kubernetes RBAC and cluster setup? (Choose TWO)
32An auditor reviews an enterprise's hybrid cloud identity architecture. Which TWO of the following configurations represent insecure identity practices? (Choose TWO)
33During an AWS security review, a penetration tester identifies several identity and storage policies. Which TWO of the following configurations are considered insecure? (Choose TWO)
34A penetration tester is auditing an AWS environment and discovers that an IAM role used by an EC2 instance has an overly permissive trust policy allowing any principal in an external AWS account to assume it without specifying an ExternalId. What is the standard security term and remediation for this vulnerability?
35A penetration tester is analyzing an Azure environment and discovers that an Azure Function App has been configured with managed identity enabled and possesses 'Contributor' access to the subscription. The function code contains a Server-Side Request Forgery (SSRF) vulnerability. How can the tester exploit the Azure Instance Metadata Service (IMDS) via this SSRF to elevate privileges?
36When reviewing container security and Kubernetes cluster configurations, which THREE practices or misconfigurations commonly lead to container escapes or host compromise? (Choose three)
37A penetration tester is assessing a Microsoft 365 tenant and discovers that a global administrator account has no multi-factor authentication (MFA) enforcement. The tester wants to exploit this to gain persistent access to the tenant's email and files. Which Azure AD feature, if misconfigured, would allow the attacker to maintain access even after the initial password is changed?
38During a penetration test of a Microsoft Azure environment, a tester obtains a managed identity token for a virtual machine. The token has permissions to read secrets from an Azure Key Vault. Which technique can the tester use to escalate privileges by leveraging the Key Vault access?
39A penetration tester is evaluating a Google Cloud Platform (GCP) environment and discovers a service account key file stored in a public Cloud Storage bucket. The service account has the roles/editor role on the project. What is the most direct way for the tester to leverage this key to gain unauthorized access to the project's resources?
40A penetration tester is assessing a Microsoft Azure environment and discovers that a virtual machine (VM) has a system-assigned managed identity enabled. The VM is running a web application that is vulnerable to server-side request forgery (SSRF). The tester wants to exploit the SSRF to gain access to Azure resources. Which TWO of the following actions can the tester perform to leverage the managed identity? (Choose two.)
41During a CPENT engagement against a Microsoft 365 tenant, you obtain a low-privileged user's credentials and successfully authenticate. You need to determine whether the tenant has enabled Security Defaults or configured custom Conditional Access policies, because this affects your ability to perform password spraying and legacy authentication attacks. Which Microsoft Graph endpoint should you query to retrieve the tenant's Conditional Access policy configuration?
42A CPENT tester is targeting a hybrid cloud environment that uses AWS IAM Identity Center (successor to AWS Single Sign-On) to federate with an on-premises Active Directory. The tester has obtained read-only access to the AWS Organizations management account. Which TWO actions should the tester perform to enumerate potential privilege escalation paths into member accounts? (Choose two.)
43A penetration tester is assessing a Microsoft Azure environment and finds that a virtual machine has a system-assigned managed identity. The tester has obtained a shell on the VM and wants to use the managed identity to access an Azure Key Vault. Which endpoint should the tester query to obtain an access token for the Key Vault?
You must analyze real cloud and container configurations, trace how misconfigurations chain into host or tenant compromise, and distinguish genuine deficiencies from noise. The single most important skill is mapping an observed weakness to the exact privilege or data it actually grants an attacker.
The Courseiva CPENT question bank contains 43 questions in the Cloud And Hybrid Infrastructure Security domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Cloud And Hybrid Infrastructure Security domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included