Cloud And Hybrid Infrastructure Security

A penetration tester is analyzing a Kubernetes cluster deployed on AWS (EKS) where a compromised pod is running with a service account that has access to the AWS IAM OIDC provider endpoint. The pod's container is running as root and has the host network namespace enabled. Which technique allows the tester to pivot from the container to the underlying cloud infrastructure?

While reviewing a hybrid identity deployment utilizing Azure AD Connect, a penetration tester observes that Password Hash Sync (PHS) is enabled alongside Pass-Through Authentication (PTA). What security implication does this configuration present during an on-premises domain compromise?

An auditor finds an Amazon S3 bucket configured with public read access enabled via an Access Control List (ACL), but the bucket policy explicitly denies public read access. How does AWS evaluate these conflicting permissions?

A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?

During an Azure assessment, an auditor finds that a Logic App has an HTTP trigger with no authentication mechanism configured (Anonymous access). The Logic App has permissions to read sensitive Azure Blob Storage containers. What type of vulnerability does this represent?

During an assessment of an Azure tenant, an attacker successfully exploits a user credential and enumerates enterprise applications. They identify a service principal with a high-privilege app role assignment (e.g., PrivilegedRoleAdministrator.ReadWrite.All). What is the primary attack path enabled by this misconfiguration?

An AWS penetration tester identifies an EC2 instance configured with an IAM instance profile that grants broad s3:* permissions across all S3 buckets in the account. What AWS service feature should be recommended to restrict these permissions based on least privilege?

A penetration tester is evaluating an AWS environment and discovers that an IAM role attached to an Amazon EC2 instance has an overly permissive trust policy allowing any user in the account to assume it via the sts:AssumeRole API without external conditions. Which specific remediation step should the cloud administrator apply to fix this risk?

An AWS administrator wants to prevent users from accidentally creating public Amazon S3 buckets across the entire AWS account. Which specific AWS feature should be enabled?

In a hybrid enterprise environment, an organization uses Azure AD Seamless Single Sign-On (Seamless SSO). During a penetration test, an attacker compromises a domain-joined workstation and attempts to abuse Seamless SSO. What is the mechanism by which Seamless SSO authenticates users, and what is a known security consideration?

A penetration tester is analyzing a Kubernetes cluster where a pod has the hostPath volume configured to mount the host's /var/run/docker.sock file. The container runs a standard Linux distribution without tools installed. How can the tester leverage this configuration to achieve a full cluster takeover?

An auditor reviews an Azure storage account and notes that 'Secure transfer required' is set to Disabled. What security risk does this misconfiguration introduce?

During an assessment of a Google Cloud Platform (GCP) environment, a penetration tester finds a Compute Engine instance with default service account credentials and scopes set to https://www.googleapis.com/auth/cloud-platform. What security implication does this broad scope present?

A security engineer discovers that an AWS IAM user has an active access key and permissions to run ec2:RunInstances, iam:PassRole, and iam:CreateRole. What privilege escalation path does this permission combination represent?

An AWS penetration tester discovers that an Amazon RDS database instance has the 'Publicly Accessible' flag set to true, and its security group allows inbound traffic from 0.0.0.0/0 on port 3306. What is the immediate risk, and what is the recommended control?

A penetration tester is analyzing a Kubernetes deployment where a ClusterRole grants the verbs get, list, and watch on secrets, combined with a ClusterRoleBinding assigning this to a default service account in a public-facing namespace. How can an external attacker exploit this configuration?

During an Azure assessment, an attacker discovers that an App Service web application has Managed Identity enabled and the underlying application code is vulnerable to Server-Side Request Forgery (SSRF). How can the attacker chain these vulnerabilities?

An administrator needs to secure communication between microservices running across different AWS Virtual Private Clouds (VPCs). Which native AWS networking feature provides private connectivity without exposing traffic to the public internet?

A penetration tester is evaluating a Kubernetes cluster utilizing Role-Based Access Control (RBAC) and notes that a custom role has the create verb on pods/exec resources. What security risk does this specific permission entail?

An attacker gains access to an Azure environment and enumerates App Service Configuration settings. They discover that connection strings and database passwords are stored in plaintext within the application settings rather than being referenced via Azure Key Vault references. What attack path does this enable?

A penetration tester is assessing an AWS environment where an AWS Lambda function has an execution role with permissions to invoke other Lambda functions and update IAM policies. The function code is vulnerable to command injection. How can this be leveraged for persistence or privilege escalation?

During an AWS penetration test, the tester finds an Amazon API Gateway REST API configured with an AWS_IAM authorizer, but one specific method is mistakenly set to 'Authorization: None' (Open API method). What security risk does this introduce?

An auditor identifies that an organization's Azure storage account allows anonymous public read access to containers and blobs. What configuration change must be applied to remediate this finding?

A penetration tester is evaluating a hybrid Active Directory environment. They compromise an on-premises user account that has been synchronized to Azure AD. They discover that the on-premises account is a member of a high-privilege local group, but Azure AD Connect has filtered out this group synchronization. How can the tester leverage Azure AD Connect configuration weaknesses?

A penetration tester is assessing an AWS environment where an EC2 instance is associated with an IAM role that trusts an external third-party AWS account in its trust policy, but the external account ID was mistyped or left overly broad (e.g., condition missing external ID or using an insecure principal). What vulnerability does this introduce?

An AWS penetration tester uncovers an IAM policy attached to a user that contains the action 'iam:PutUserPolicy' with a resource of '*'. What privilege escalation vector does this enable?

An auditor is reviewing an Azure Kubernetes Service (AKS) cluster and discovers that Role-Based Access Control (RBAC) was disabled during cluster creation, and Azure Active Directory integration is not enabled. What is the primary security consequence?

During an assessment of a Google Cloud Platform project, a penetration tester finds that a Cloud Storage bucket has the allUsers principal granted the Storage Object Viewer role. What security flaw does this represent, and how should it be fixed?

An Azure penetration tester identifies a Virtual Machine with public IP access that has an incoming Network Security Group (NSG) rule allowing TCP port 3389 (RDP) from any source ('Any' or 'Internet'). What is the recommended remediation?

A penetration tester is analyzing a Kubernetes cluster where pods utilize service accounts with automountServiceAccountToken set to true globally or on sensitive pods. The tester gains remote code execution inside a pod running with a high-privilege service account token. How can they use this token against the Kubernetes API?

An AWS administrator wants to ensure that all data stored in newly created Amazon S3 buckets is automatically encrypted at rest using server-side encryption with customer-managed keys (SSE-KMS). What is the most scalable way to enforce this?

During an Azure penetration test, an attacker identifies an Azure Function with an HTTP trigger that uses function-level keys. However, the function key was leaked in a public GitHub repository. What level of access does this key provide?

A penetration tester is evaluating a Kubernetes environment and discovers that the Kubernetes dashboard is deployed with cluster-admin privileges and is exposed to the internet via a NodePort service without authentication. How can this be exploited?

An AWS penetration tester discovers that an Amazon DynamoDB table contains sensitive PII stored in plaintext, and the table is encrypted using the default AWS owned key rather than a customer managed KMS key. What is the security recommendation?

An auditor is reviewing an AWS cloud environment and identifies several common misconfigurations related to identity and access management. Which TWO of the following practices represent significant security risks? (Choose TWO)

During a penetration test of an Azure Active Directory tenant, an attacker identifies multiple security misconfigurations. Which TWO of the following techniques represent common Azure AD attack vectors or misconfigurations? (Choose TWO)

A penetration tester is assessing a Kubernetes cluster deployment. Which THREE of the following container or cluster configurations represent severe container escape or privilege escalation risks? (Choose THREE)

During a hybrid cloud assessment, a penetration tester examines the connection between an on-premises Active Directory and Azure AD. Which THREE of the following mechanisms or misconfigurations could lead to credential exposure or privilege escalation in the hybrid environment? (Choose THREE)

An auditor is evaluating cloud storage security across multiple cloud providers. Which TWO of the following settings indicate improper security configurations for cloud storage buckets? (Choose TWO)

A penetration tester is evaluating AWS IAM policies for privilege escalation paths. Which THREE of the following IAM action combinations enable direct or indirect privilege escalation in an AWS environment? (Choose THREE)

During an Azure subscription review, a security assessor checks for role-based access control and resource configuration best practices. Which TWO of the following findings represent high-severity security risks? (Choose TWO)

An auditor reviews network security configurations in an AWS VPC. Which TWO of the following network configurations represent potential security risks? (Choose TWO)

A penetration tester is analyzing an enterprise cloud infrastructure utilizing both AWS and Azure. Which THREE of the following attack vectors or misconfigurations are relevant to hybrid and cloud security assessments? (Choose THREE)

An auditor reviews cloud logging and monitoring configurations across an enterprise multi-cloud environment. Which TWO of the following practices represent critical security deficiencies? (Choose TWO)

During a Kubernetes cluster security assessment, a penetration tester identifies multiple misconfigurations. Which TWO of the following findings represent high-risk security flaws in Kubernetes RBAC and cluster setup? (Choose TWO)

A penetration tester is evaluating cloud container security and hybrid orchestration platforms. Which THREE of the following techniques or conditions facilitate container escapes or host compromise? (Choose THREE)

An auditor reviews an enterprise's hybrid cloud identity architecture. Which TWO of the following configurations represent insecure identity practices? (Choose TWO)

During an AWS security review, a penetration tester identifies several identity and storage policies. Which TWO of the following configurations are considered insecure? (Choose TWO)

A penetration tester is auditing an AWS environment and discovers that an IAM role used by an EC2 instance has an overly permissive trust policy allowing any principal in an external AWS account to assume it without specifying an ExternalId. What is the standard security term and remediation for this vulnerability?

A penetration tester is assessing an advanced hybrid cloud and Kubernetes infrastructure. Which THREE of the following scenarios represent critical architecture or configuration flaws? (Choose THREE)

During an assessment of a hybrid Active Directory environment, a penetration tester compromises an on-premises user account that is synchronized to Azure AD via Azure AD Connect. The tester notices that the on-premises account is a member of the local 'Backup Operators' group. Which hybrid attack path is most directly enabled by this configuration?

An organization stores sensitive application backups in an Amazon S3 bucket. During a cloud penetration test, the tester finds that the S3 bucket policy explicitly allows 's3:GetObject' to '*' without any AWS:SourceIp or aws:SourceArn conditions, but the bucket is marked with 'Block Public Access' enabled at the account level. What is the impact of this configuration?

A penetration tester is performing a container escape on a Kubernetes cluster. The tester gains remote code execution inside a pod and discovers that the container is running with privileged mode disabled, but the service account token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token has permissions to create new Pods using the cluster-admin cluster role. Which kubectl command or API call pattern should the tester use to achieve a container escape to the underlying host?

A penetration tester is analyzing an Azure environment and discovers that an Azure Function App has been configured with managed identity enabled and possesses 'Contributor' access to the subscription. The function code contains a Server-Side Request Forgery (SSRF) vulnerability. How can the tester exploit the Azure Instance Metadata Service (IMDS) via this SSRF to elevate privileges?

During a container security assessment, a penetration tester identifies a Kubernetes pod running with 'CAP_SYS_ADMIN' capabilities and the host's PID namespace shared ('hostPID: true'). Which technique allows the tester to escape the container and execute code on the host?

A penetration tester is reviewing an Azure Active Directory (Azure AD) tenant and finds that user writeback and device writeback are enabled in Azure AD Connect, but the service account lacks appropriate permissions in on-premises Active Directory. What security risk does misconfigured Azure AD Connect writeback pose?

A penetration tester is auditing an AWS environment and investigating potential privilege escalation paths via IAM. Which TWO of the following IAM permission combinations represent classic privilege escalation vectors in AWS? (Choose two)

During a hybrid cloud assessment, a penetration tester discovers that an organization uses Azure Arc to manage on-premises Windows servers. Which THREE security risks or attack vectors are associated with a compromised Azure Arc Connected Machine Agent (azcmagent) on an on-premises server? (Choose three)

When reviewing container security and Kubernetes cluster configurations, which THREE practices or misconfigurations commonly lead to container escapes or host compromise? (Choose three)