CPENT Cloud And Hybrid Infrastructure Security — All Questions With Answers

Question 1hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is analyzing a Kubernetes cluster deployed on AWS (EKS) where a compromised pod is running with a service account that has access to the AWS IAM OIDC provider endpoint. The pod's container is running as root and has the host network namespace enabled. Which technique allows the tester to pivot from the container to the underlying cloud infrastructure?

Question 2mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

While reviewing a hybrid identity deployment utilizing Azure AD Connect, a penetration tester observes that Password Hash Sync (PHS) is enabled alongside Pass-Through Authentication (PTA). What security implication does this configuration present during an on-premises domain compromise?

Question 3mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an Azure assessment, an auditor finds that a Logic App has an HTTP trigger with no authentication mechanism configured (Anonymous access). The Logic App has permissions to read sensitive Azure Blob Storage containers. What type of vulnerability does this represent?

Question 4mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an assessment of an Azure tenant, an attacker successfully exploits a user credential and enumerates enterprise applications. They identify a service principal with a high-privilege app role assignment (e.g., PrivilegedRoleAdministrator.ReadWrite.All). What is the primary attack path enabled by this misconfiguration?

Question 5easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An AWS penetration tester identifies an EC2 instance configured with an IAM instance profile that grants broad s3:* permissions across all S3 buckets in the account. What AWS service feature should be recommended to restrict these permissions based on least privilege?

Question 6easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An AWS administrator wants to prevent users from accidentally creating public Amazon S3 buckets across the entire AWS account. Which specific AWS feature should be enabled?

Question 7hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is analyzing a Kubernetes cluster where a pod has the hostPath volume configured to mount the host's /var/run/docker.sock file. The container runs a standard Linux distribution without tools installed. How can the tester leverage this configuration to achieve a full cluster takeover?

Question 8hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing an AWS environment where an AWS Lambda function has an execution role with permissions to invoke other Lambda functions and update IAM policies. The function code is vulnerable to command injection. How can this be leveraged for persistence or privilege escalation?

Question 9easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An AWS administrator wants to ensure that all data stored in newly created Amazon S3 buckets is automatically encrypted at rest using server-side encryption with customer-managed keys (SSE-KMS). What is the most scalable way to enforce this?

Question 10easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An AWS penetration tester discovers that an Amazon DynamoDB table contains sensitive PII stored in plaintext, and the table is encrypted using the default AWS owned key rather than a customer managed KMS key. What is the security recommendation?

Question 11hardmulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a Kubernetes cluster deployment. Which THREE of the following container or cluster configurations represent severe container escape or privilege escalation risks? (Choose THREE)

Question 12mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

During a hybrid cloud assessment, a penetration tester examines the connection between an on-premises Active Directory and Azure AD. Which THREE of the following mechanisms or misconfigurations could lead to credential exposure or privilege escalation in the hybrid environment? (Choose THREE)

Question 13hardmulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is evaluating AWS IAM policies for privilege escalation paths. Which THREE of the following IAM action combinations enable direct or indirect privilege escalation in an AWS environment? (Choose THREE)

Question 14hardmulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is analyzing an enterprise cloud infrastructure utilizing both AWS and Azure. Which THREE of the following attack vectors or misconfigurations are relevant to hybrid and cloud security assessments? (Choose THREE)

Question 15hardmulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is evaluating cloud container security and hybrid orchestration platforms. Which THREE of the following techniques or conditions facilitate container escapes or host compromise? (Choose THREE)

Question 16hardmulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing an advanced hybrid cloud and Kubernetes infrastructure. Which THREE of the following scenarios represent critical architecture or configuration flaws? (Choose THREE)

Question 17mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an assessment of a hybrid Active Directory environment, a penetration tester compromises an on-premises user account that is synchronized to Azure AD via Azure AD Connect. The tester notices that the on-premises account is a member of the local 'Backup Operators' group. Which hybrid attack path is most directly enabled by this configuration?

Question 18easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An organization stores sensitive application backups in an Amazon S3 bucket. During a cloud penetration test, the tester finds that the S3 bucket policy explicitly allows 's3:GetObject' to '*' without any AWS:SourceIp or aws:SourceArn conditions, but the bucket is marked with 'Block Public Access' enabled at the account level. What is the impact of this configuration?

Question 19hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is performing a container escape on a Kubernetes cluster. The tester gains remote code execution inside a pod and discovers that the container is running with privileged mode disabled, but the service account token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token has permissions to create new Pods using the cluster-admin cluster role. Which kubectl command or API call pattern should the tester use to achieve a container escape to the underlying host?

Question 20hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During a container security assessment, a penetration tester identifies a Kubernetes pod running with 'CAP_SYS_ADMIN' capabilities and the host's PID namespace shared ('hostPID: true'). Which technique allows the tester to escape the container and execute code on the host?

Question 21easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is reviewing an Azure Active Directory (Azure AD) tenant and finds that user writeback and device writeback are enabled in Azure AD Connect, but the service account lacks appropriate permissions in on-premises Active Directory. What security risk does misconfigured Azure AD Connect writeback pose?

Question 22mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is auditing an AWS environment and investigating potential privilege escalation paths via IAM. Which TWO of the following IAM permission combinations represent classic privilege escalation vectors in AWS? (Choose two)

Question 23hardmulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

During a hybrid cloud assessment, a penetration tester discovers that an organization uses Azure Arc to manage on-premises Windows servers. Which THREE security risks or attack vectors are associated with a compromised Azure Arc Connected Machine Agent (azcmagent) on an on-premises server? (Choose three)

Question 24mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing an AWS environment and discovers an EC2 instance with an attached IAM role that has permissions to call sts:AssumeRole. The tester also finds that the role's trust policy allows any principal in the same account to assume it. Which attack technique can the tester use to escalate privileges within the account?

Question 25hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is analyzing an AWS environment and finds an EC2 instance with an attached IAM role that has the permissions ec2:DescribeInstances, ec2:CreateTags, and iam:PassRole. The role also has a trust relationship allowing the EC2 service to assume it. The tester wants to escalate privileges by launching a new EC2 instance with an existing high-privileged role. Which sequence of AWS CLI commands would achieve this?

Question 26mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a hybrid cloud environment that uses Azure AD Connect to synchronize on-premises Active Directory with Azure AD. The tester has obtained credentials for a synchronized user account that has the password hash synchronized to Azure AD. Which TWO of the following attacks can the tester perform to move laterally or escalate privileges in the cloud environment? (Choose two.)

Question 27mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a hybrid cloud environment where on-premises Active Directory is synchronized with Azure AD using Azure AD Connect. The tester compromises an on-premises user account that has the 'Password Reset' permission on a user object in Active Directory. Which attack can the tester perform to escalate privileges in Azure AD?

Question 28mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a Google Cloud Platform (GCP) organization. During enumeration, the tester discovers that the default Compute Engine service account is enabled and attached to all newly created virtual machine instances. The tester also finds that the service account has the Editor role at the project level. What is the MOST likely privilege escalation path an attacker could exploit?

Question 29hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is performing a security assessment of a hybrid cloud environment that uses Microsoft Azure AD Connect to synchronize on-premises Active Directory with Azure Active Directory. The tester gains access to the on-premises network and discovers that the Azure AD Connect server is configured with the Password Hash Synchronization (PHS) feature. The tester also finds that the AD Connect service account has the 'Replicate Directory Changes' permission on the domain. What is the MOST effective attack to obtain credentials for privileged Azure AD accounts?

Question 30easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is evaluating an Amazon Web Services (AWS) environment and discovers that an Amazon S3 bucket has been configured with a bucket policy that allows public read access to all objects. The bucket contains sensitive customer data. The tester wants to demonstrate the impact of this misconfiguration. Which of the following commands would the tester use to list the contents of the bucket without authentication?

Question 31hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a hybrid cloud environment that uses Azure AD Connect with Password Hash Synchronization (PHS) to synchronize on-premises Active Directory with Azure AD. The tester has compromised an on-premises workstation and obtained the credentials of a user who is a member of the 'Azure AD Connect Sync' group. The tester wants to escalate privileges to Azure AD Global Administrator. Which of the following actions would BEST achieve this goal?

Question 32hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

You are conducting a CPENT assessment of a hybrid environment where an on-premises Active Directory connects to Microsoft Entra ID via Microsoft Entra Connect. You compromise a workstation and recover the credentials of the Entra Connect synchronization account (MSOL_ or ADSync). Which attack path should you prioritize to escalate to full tenant compromise?

Question 33mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an authorized penetration test of a company's Microsoft 365 tenant, you compromise a standard user account that has no administrative roles. You need to identify all SharePoint Online sites the user can access, then attempt to escalate privileges by abusing a misconfigured sharing link. Which Microsoft Graph API permission scope would allow you to enumerate the sites the user can access without requiring tenant-wide admin consent?

Question 34hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a hybrid environment where an on-premises Active Directory connects to Azure AD via Azure AD Connect. The tester has obtained credentials for a service account used by Azure AD Connect. Which attack technique would allow the tester to escalate privileges in the Azure AD tenant by leveraging this service account?

Question 35hardmulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is conducting an assessment of a Kubernetes cluster hosted on Google Kubernetes Engine (GKE). The tester has compromised a pod that runs with a service account token mounted. Which TWO of the following actions could the tester perform to escalate privileges within the cluster? (Choose two.)

Question 36easymultiple choice

Study the full ACL explanation →

An auditor finds an Amazon S3 bucket configured with public read access enabled via an Access Control List (ACL), but the bucket policy explicitly denies public read access. How does AWS evaluate these conflicting permissions?

Question 37hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?

Question 38easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is evaluating an AWS environment and discovers that an IAM role attached to an Amazon EC2 instance has an overly permissive trust policy allowing any user in the account to assume it via the sts:AssumeRole API without external conditions. Which specific remediation step should the cloud administrator apply to fix this risk?

Question 39mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

In a hybrid enterprise environment, an organization uses Azure AD Seamless Single Sign-On (Seamless SSO). During a penetration test, an attacker compromises a domain-joined workstation and attempts to abuse Seamless SSO. What is the mechanism by which Seamless SSO authenticates users, and what is a known security consideration?

Question 40easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An auditor reviews an Azure storage account and notes that 'Secure transfer required' is set to Disabled. What security risk does this misconfiguration introduce?

Question 41mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an assessment of a Google Cloud Platform (GCP) environment, a penetration tester finds a Compute Engine instance with default service account credentials and scopes set to https://www.googleapis.com/auth/cloud-platform. What security implication does this broad scope present?

Question 42hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A security engineer discovers that an AWS IAM user has an active access key and permissions to run ec2:RunInstances, iam:PassRole, and iam:CreateRole. What privilege escalation path does this permission combination represent?

Question 43easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An AWS penetration tester discovers that an Amazon RDS database instance has the 'Publicly Accessible' flag set to true, and its security group allows inbound traffic from 0.0.0.0/0 on port 3306. What is the immediate risk, and what is the recommended control?

Question 44hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is analyzing a Kubernetes deployment where a ClusterRole grants the verbs get, list, and watch on secrets, combined with a ClusterRoleBinding assigning this to a default service account in a public-facing namespace. How can an external attacker exploit this configuration?

Question 45mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an Azure assessment, an attacker discovers that an App Service web application has Managed Identity enabled and the underlying application code is vulnerable to Server-Side Request Forgery (SSRF). How can the attacker chain these vulnerabilities?

Question 46easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An administrator needs to secure communication between microservices running across different AWS Virtual Private Clouds (VPCs). Which native AWS networking feature provides private connectivity without exposing traffic to the public internet?

Question 47hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is evaluating a Kubernetes cluster utilizing Role-Based Access Control (RBAC) and notes that a custom role has the create verb on pods/exec resources. What security risk does this specific permission entail?

Question 48mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An attacker gains access to an Azure environment and enumerates App Service Configuration settings. They discover that connection strings and database passwords are stored in plaintext within the application settings rather than being referenced via Azure Key Vault references. What attack path does this enable?

Question 49mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an AWS penetration test, the tester finds an Amazon API Gateway REST API configured with an AWS_IAM authorizer, but one specific method is mistakenly set to 'Authorization: None' (Open API method). What security risk does this introduce?

Question 50easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An auditor identifies that an organization's Azure storage account allows anonymous public read access to containers and blobs. What configuration change must be applied to remediate this finding?

Question 51hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is evaluating a hybrid Active Directory environment. They compromise an on-premises user account that has been synchronized to Azure AD. They discover that the on-premises account is a member of a high-privilege local group, but Azure AD Connect has filtered out this group synchronization. How can the tester leverage Azure AD Connect configuration weaknesses?

Question 52hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing an AWS environment where an EC2 instance is associated with an IAM role that trusts an external third-party AWS account in its trust policy, but the external account ID was mistyped or left overly broad (e.g., condition missing external ID or using an insecure principal). What vulnerability does this introduce?

Question 53easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An AWS penetration tester uncovers an IAM policy attached to a user that contains the action 'iam:PutUserPolicy' with a resource of '*'. What privilege escalation vector does this enable?

Question 54mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An auditor is reviewing an Azure Kubernetes Service (AKS) cluster and discovers that Role-Based Access Control (RBAC) was disabled during cluster creation, and Azure Active Directory integration is not enabled. What is the primary security consequence?

Question 55mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an assessment of a Google Cloud Platform project, a penetration tester finds that a Cloud Storage bucket has the allUsers principal granted the Storage Object Viewer role. What security flaw does this represent, and how should it be fixed?

Question 56easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An Azure penetration tester identifies a Virtual Machine with public IP access that has an incoming Network Security Group (NSG) rule allowing TCP port 3389 (RDP) from any source ('Any' or 'Internet'). What is the recommended remediation?

Question 57hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is analyzing a Kubernetes cluster where pods utilize service accounts with automountServiceAccountToken set to true globally or on sensitive pods. The tester gains remote code execution inside a pod running with a high-privilege service account token. How can they use this token against the Kubernetes API?

Question 58mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an Azure penetration test, an attacker identifies an Azure Function with an HTTP trigger that uses function-level keys. However, the function key was leaked in a public GitHub repository. What level of access does this key provide?

Question 59hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is evaluating a Kubernetes environment and discovers that the Kubernetes dashboard is deployed with cluster-admin privileges and is exposed to the internet via a NodePort service without authentication. How can this be exploited?

Question 60easymulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

An auditor is reviewing an AWS cloud environment and identifies several common misconfigurations related to identity and access management. Which TWO of the following practices represent significant security risks? (Choose TWO)

Question 61mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

During a penetration test of an Azure Active Directory tenant, an attacker identifies multiple security misconfigurations. Which TWO of the following techniques represent common Azure AD attack vectors or misconfigurations? (Choose TWO)

Question 62easymulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

An auditor is evaluating cloud storage security across multiple cloud providers. Which TWO of the following settings indicate improper security configurations for cloud storage buckets? (Choose TWO)

Question 63mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an Azure subscription review, a security assessor checks for role-based access control and resource configuration best practices. Which TWO of the following findings represent high-severity security risks? (Choose TWO)

Question 64easymulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

An auditor reviews network security configurations in an AWS VPC. Which TWO of the following network configurations represent potential security risks? (Choose TWO)

Question 65easymulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

An auditor reviews cloud logging and monitoring configurations across an enterprise multi-cloud environment. Which TWO of the following practices represent critical security deficiencies? (Choose TWO)

Question 66mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

During a Kubernetes cluster security assessment, a penetration tester identifies multiple misconfigurations. Which TWO of the following findings represent high-risk security flaws in Kubernetes RBAC and cluster setup? (Choose TWO)

Question 67easymulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

An auditor reviews an enterprise's hybrid cloud identity architecture. Which TWO of the following configurations represent insecure identity practices? (Choose TWO)

Question 68mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an AWS security review, a penetration tester identifies several identity and storage policies. Which TWO of the following configurations are considered insecure? (Choose TWO)

Question 69easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is auditing an AWS environment and discovers that an IAM role used by an EC2 instance has an overly permissive trust policy allowing any principal in an external AWS account to assume it without specifying an ExternalId. What is the standard security term and remediation for this vulnerability?

Question 70mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is analyzing an Azure environment and discovers that an Azure Function App has been configured with managed identity enabled and possesses 'Contributor' access to the subscription. The function code contains a Server-Side Request Forgery (SSRF) vulnerability. How can the tester exploit the Azure Instance Metadata Service (IMDS) via this SSRF to elevate privileges?

Question 71easymulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

When reviewing container security and Kubernetes cluster configurations, which THREE practices or misconfigurations commonly lead to container escapes or host compromise? (Choose three)

Question 72mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a Microsoft 365 tenant and discovers that a global administrator account has no multi-factor authentication (MFA) enforcement. The tester wants to exploit this to gain persistent access to the tenant's email and files. Which Azure AD feature, if misconfigured, would allow the attacker to maintain access even after the initial password is changed?

Question 73hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During a penetration test of a Microsoft Azure environment, a tester obtains a managed identity token for a virtual machine. The token has permissions to read secrets from an Azure Key Vault. Which technique can the tester use to escalate privileges by leveraging the Key Vault access?

Question 74easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is evaluating a Google Cloud Platform (GCP) environment and discovers a service account key file stored in a public Cloud Storage bucket. The service account has the roles/editor role on the project. What is the most direct way for the tester to leverage this key to gain unauthorized access to the project's resources?

Question 75mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a Microsoft Azure environment and discovers that a virtual machine (VM) has a system-assigned managed identity enabled. The VM is running a web application that is vulnerable to server-side request forgery (SSRF). The tester wants to exploit the SSRF to gain access to Azure resources. Which TWO of the following actions can the tester perform to leverage the managed identity? (Choose two.)

Question 76mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During a CPENT engagement against a Microsoft 365 tenant, you obtain a low-privileged user's credentials and successfully authenticate. You need to determine whether the tenant has enabled Security Defaults or configured custom Conditional Access policies, because this affects your ability to perform password spraying and legacy authentication attacks. Which Microsoft Graph endpoint should you query to retrieve the tenant's Conditional Access policy configuration?

Question 77mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A CPENT tester is targeting a hybrid cloud environment that uses AWS IAM Identity Center (successor to AWS Single Sign-On) to federate with an on-premises Active Directory. The tester has obtained read-only access to the AWS Organizations management account. Which TWO actions should the tester perform to enumerate potential privilege escalation paths into member accounts? (Choose two.)

Question 78easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a Microsoft Azure environment and finds that a virtual machine has a system-assigned managed identity. The tester has obtained a shell on the VM and wants to use the managed identity to access an Azure Key Vault. Which endpoint should the tester query to obtain an access token for the Key Vault?

Question 1hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is analyzing a Kubernetes cluster deployed on AWS (EKS) where a compromised pod is running with a service account that has access to the AWS IAM OIDC provider endpoint. The pod's container is running as root and has the host network namespace enabled. Which technique allows the tester to pivot from the container to the underlying cloud infrastructure?

Question 2mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

While reviewing a hybrid identity deployment utilizing Azure AD Connect, a penetration tester observes that Password Hash Sync (PHS) is enabled alongside Pass-Through Authentication (PTA). What security implication does this configuration present during an on-premises domain compromise?

Question 3mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an Azure assessment, an auditor finds that a Logic App has an HTTP trigger with no authentication mechanism configured (Anonymous access). The Logic App has permissions to read sensitive Azure Blob Storage containers. What type of vulnerability does this represent?

Question 4mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an assessment of an Azure tenant, an attacker successfully exploits a user credential and enumerates enterprise applications. They identify a service principal with a high-privilege app role assignment (e.g., PrivilegedRoleAdministrator.ReadWrite.All). What is the primary attack path enabled by this misconfiguration?

Question 5easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An AWS penetration tester identifies an EC2 instance configured with an IAM instance profile that grants broad s3:* permissions across all S3 buckets in the account. What AWS service feature should be recommended to restrict these permissions based on least privilege?

Question 6easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An AWS administrator wants to prevent users from accidentally creating public Amazon S3 buckets across the entire AWS account. Which specific AWS feature should be enabled?

Question 7hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is analyzing a Kubernetes cluster where a pod has the hostPath volume configured to mount the host's /var/run/docker.sock file. The container runs a standard Linux distribution without tools installed. How can the tester leverage this configuration to achieve a full cluster takeover?

Question 8hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing an AWS environment where an AWS Lambda function has an execution role with permissions to invoke other Lambda functions and update IAM policies. The function code is vulnerable to command injection. How can this be leveraged for persistence or privilege escalation?

Question 9easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An AWS administrator wants to ensure that all data stored in newly created Amazon S3 buckets is automatically encrypted at rest using server-side encryption with customer-managed keys (SSE-KMS). What is the most scalable way to enforce this?

Question 10easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An AWS penetration tester discovers that an Amazon DynamoDB table contains sensitive PII stored in plaintext, and the table is encrypted using the default AWS owned key rather than a customer managed KMS key. What is the security recommendation?

Question 11hardmulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a Kubernetes cluster deployment. Which THREE of the following container or cluster configurations represent severe container escape or privilege escalation risks? (Choose THREE)

Question 12mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

During a hybrid cloud assessment, a penetration tester examines the connection between an on-premises Active Directory and Azure AD. Which THREE of the following mechanisms or misconfigurations could lead to credential exposure or privilege escalation in the hybrid environment? (Choose THREE)

Question 13hardmulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is evaluating AWS IAM policies for privilege escalation paths. Which THREE of the following IAM action combinations enable direct or indirect privilege escalation in an AWS environment? (Choose THREE)

Question 14hardmulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is analyzing an enterprise cloud infrastructure utilizing both AWS and Azure. Which THREE of the following attack vectors or misconfigurations are relevant to hybrid and cloud security assessments? (Choose THREE)

Question 15hardmulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is evaluating cloud container security and hybrid orchestration platforms. Which THREE of the following techniques or conditions facilitate container escapes or host compromise? (Choose THREE)

Question 16hardmulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing an advanced hybrid cloud and Kubernetes infrastructure. Which THREE of the following scenarios represent critical architecture or configuration flaws? (Choose THREE)

Question 17mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an assessment of a hybrid Active Directory environment, a penetration tester compromises an on-premises user account that is synchronized to Azure AD via Azure AD Connect. The tester notices that the on-premises account is a member of the local 'Backup Operators' group. Which hybrid attack path is most directly enabled by this configuration?

Question 18easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An organization stores sensitive application backups in an Amazon S3 bucket. During a cloud penetration test, the tester finds that the S3 bucket policy explicitly allows 's3:GetObject' to '*' without any AWS:SourceIp or aws:SourceArn conditions, but the bucket is marked with 'Block Public Access' enabled at the account level. What is the impact of this configuration?

Question 19hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is performing a container escape on a Kubernetes cluster. The tester gains remote code execution inside a pod and discovers that the container is running with privileged mode disabled, but the service account token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token has permissions to create new Pods using the cluster-admin cluster role. Which kubectl command or API call pattern should the tester use to achieve a container escape to the underlying host?

Question 20hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During a container security assessment, a penetration tester identifies a Kubernetes pod running with 'CAP_SYS_ADMIN' capabilities and the host's PID namespace shared ('hostPID: true'). Which technique allows the tester to escape the container and execute code on the host?

Question 21easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is reviewing an Azure Active Directory (Azure AD) tenant and finds that user writeback and device writeback are enabled in Azure AD Connect, but the service account lacks appropriate permissions in on-premises Active Directory. What security risk does misconfigured Azure AD Connect writeback pose?

Question 22mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is auditing an AWS environment and investigating potential privilege escalation paths via IAM. Which TWO of the following IAM permission combinations represent classic privilege escalation vectors in AWS? (Choose two)

Question 23hardmulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

During a hybrid cloud assessment, a penetration tester discovers that an organization uses Azure Arc to manage on-premises Windows servers. Which THREE security risks or attack vectors are associated with a compromised Azure Arc Connected Machine Agent (azcmagent) on an on-premises server? (Choose three)

Question 24mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing an AWS environment and discovers an EC2 instance with an attached IAM role that has permissions to call sts:AssumeRole. The tester also finds that the role's trust policy allows any principal in the same account to assume it. Which attack technique can the tester use to escalate privileges within the account?

Question 25hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is analyzing an AWS environment and finds an EC2 instance with an attached IAM role that has the permissions ec2:DescribeInstances, ec2:CreateTags, and iam:PassRole. The role also has a trust relationship allowing the EC2 service to assume it. The tester wants to escalate privileges by launching a new EC2 instance with an existing high-privileged role. Which sequence of AWS CLI commands would achieve this?

Question 26mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a hybrid cloud environment that uses Azure AD Connect to synchronize on-premises Active Directory with Azure AD. The tester has obtained credentials for a synchronized user account that has the password hash synchronized to Azure AD. Which TWO of the following attacks can the tester perform to move laterally or escalate privileges in the cloud environment? (Choose two.)

Question 27mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a hybrid cloud environment where on-premises Active Directory is synchronized with Azure AD using Azure AD Connect. The tester compromises an on-premises user account that has the 'Password Reset' permission on a user object in Active Directory. Which attack can the tester perform to escalate privileges in Azure AD?

Question 28mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a Google Cloud Platform (GCP) organization. During enumeration, the tester discovers that the default Compute Engine service account is enabled and attached to all newly created virtual machine instances. The tester also finds that the service account has the Editor role at the project level. What is the MOST likely privilege escalation path an attacker could exploit?

Question 29hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is performing a security assessment of a hybrid cloud environment that uses Microsoft Azure AD Connect to synchronize on-premises Active Directory with Azure Active Directory. The tester gains access to the on-premises network and discovers that the Azure AD Connect server is configured with the Password Hash Synchronization (PHS) feature. The tester also finds that the AD Connect service account has the 'Replicate Directory Changes' permission on the domain. What is the MOST effective attack to obtain credentials for privileged Azure AD accounts?

Question 30easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is evaluating an Amazon Web Services (AWS) environment and discovers that an Amazon S3 bucket has been configured with a bucket policy that allows public read access to all objects. The bucket contains sensitive customer data. The tester wants to demonstrate the impact of this misconfiguration. Which of the following commands would the tester use to list the contents of the bucket without authentication?

Question 31hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a hybrid cloud environment that uses Azure AD Connect with Password Hash Synchronization (PHS) to synchronize on-premises Active Directory with Azure AD. The tester has compromised an on-premises workstation and obtained the credentials of a user who is a member of the 'Azure AD Connect Sync' group. The tester wants to escalate privileges to Azure AD Global Administrator. Which of the following actions would BEST achieve this goal?

Question 32hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

You are conducting a CPENT assessment of a hybrid environment where an on-premises Active Directory connects to Microsoft Entra ID via Microsoft Entra Connect. You compromise a workstation and recover the credentials of the Entra Connect synchronization account (MSOL_ or ADSync). Which attack path should you prioritize to escalate to full tenant compromise?

Question 33mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an authorized penetration test of a company's Microsoft 365 tenant, you compromise a standard user account that has no administrative roles. You need to identify all SharePoint Online sites the user can access, then attempt to escalate privileges by abusing a misconfigured sharing link. Which Microsoft Graph API permission scope would allow you to enumerate the sites the user can access without requiring tenant-wide admin consent?

Question 34hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a hybrid environment where an on-premises Active Directory connects to Azure AD via Azure AD Connect. The tester has obtained credentials for a service account used by Azure AD Connect. Which attack technique would allow the tester to escalate privileges in the Azure AD tenant by leveraging this service account?

Question 35hardmulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is conducting an assessment of a Kubernetes cluster hosted on Google Kubernetes Engine (GKE). The tester has compromised a pod that runs with a service account token mounted. Which TWO of the following actions could the tester perform to escalate privileges within the cluster? (Choose two.)

Question 36easymultiple choice

Study the full ACL explanation →

An auditor finds an Amazon S3 bucket configured with public read access enabled via an Access Control List (ACL), but the bucket policy explicitly denies public read access. How does AWS evaluate these conflicting permissions?

Question 37hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?

Question 38easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is evaluating an AWS environment and discovers that an IAM role attached to an Amazon EC2 instance has an overly permissive trust policy allowing any user in the account to assume it via the sts:AssumeRole API without external conditions. Which specific remediation step should the cloud administrator apply to fix this risk?

Question 39mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

In a hybrid enterprise environment, an organization uses Azure AD Seamless Single Sign-On (Seamless SSO). During a penetration test, an attacker compromises a domain-joined workstation and attempts to abuse Seamless SSO. What is the mechanism by which Seamless SSO authenticates users, and what is a known security consideration?

Question 40easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An auditor reviews an Azure storage account and notes that 'Secure transfer required' is set to Disabled. What security risk does this misconfiguration introduce?

Question 41mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an assessment of a Google Cloud Platform (GCP) environment, a penetration tester finds a Compute Engine instance with default service account credentials and scopes set to https://www.googleapis.com/auth/cloud-platform. What security implication does this broad scope present?

Question 42hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A security engineer discovers that an AWS IAM user has an active access key and permissions to run ec2:RunInstances, iam:PassRole, and iam:CreateRole. What privilege escalation path does this permission combination represent?

Question 43easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An AWS penetration tester discovers that an Amazon RDS database instance has the 'Publicly Accessible' flag set to true, and its security group allows inbound traffic from 0.0.0.0/0 on port 3306. What is the immediate risk, and what is the recommended control?

Question 44hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is analyzing a Kubernetes deployment where a ClusterRole grants the verbs get, list, and watch on secrets, combined with a ClusterRoleBinding assigning this to a default service account in a public-facing namespace. How can an external attacker exploit this configuration?

Question 45mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an Azure assessment, an attacker discovers that an App Service web application has Managed Identity enabled and the underlying application code is vulnerable to Server-Side Request Forgery (SSRF). How can the attacker chain these vulnerabilities?

Question 46easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An administrator needs to secure communication between microservices running across different AWS Virtual Private Clouds (VPCs). Which native AWS networking feature provides private connectivity without exposing traffic to the public internet?

Question 47hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is evaluating a Kubernetes cluster utilizing Role-Based Access Control (RBAC) and notes that a custom role has the create verb on pods/exec resources. What security risk does this specific permission entail?

Question 48mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An attacker gains access to an Azure environment and enumerates App Service Configuration settings. They discover that connection strings and database passwords are stored in plaintext within the application settings rather than being referenced via Azure Key Vault references. What attack path does this enable?

Question 49mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an AWS penetration test, the tester finds an Amazon API Gateway REST API configured with an AWS_IAM authorizer, but one specific method is mistakenly set to 'Authorization: None' (Open API method). What security risk does this introduce?

Question 50easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An auditor identifies that an organization's Azure storage account allows anonymous public read access to containers and blobs. What configuration change must be applied to remediate this finding?

Question 51hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is evaluating a hybrid Active Directory environment. They compromise an on-premises user account that has been synchronized to Azure AD. They discover that the on-premises account is a member of a high-privilege local group, but Azure AD Connect has filtered out this group synchronization. How can the tester leverage Azure AD Connect configuration weaknesses?

Question 52hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing an AWS environment where an EC2 instance is associated with an IAM role that trusts an external third-party AWS account in its trust policy, but the external account ID was mistyped or left overly broad (e.g., condition missing external ID or using an insecure principal). What vulnerability does this introduce?

Question 53easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An AWS penetration tester uncovers an IAM policy attached to a user that contains the action 'iam:PutUserPolicy' with a resource of '*'. What privilege escalation vector does this enable?

Question 54mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An auditor is reviewing an Azure Kubernetes Service (AKS) cluster and discovers that Role-Based Access Control (RBAC) was disabled during cluster creation, and Azure Active Directory integration is not enabled. What is the primary security consequence?

Question 55mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an assessment of a Google Cloud Platform project, a penetration tester finds that a Cloud Storage bucket has the allUsers principal granted the Storage Object Viewer role. What security flaw does this represent, and how should it be fixed?

Question 56easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

An Azure penetration tester identifies a Virtual Machine with public IP access that has an incoming Network Security Group (NSG) rule allowing TCP port 3389 (RDP) from any source ('Any' or 'Internet'). What is the recommended remediation?

Question 57hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is analyzing a Kubernetes cluster where pods utilize service accounts with automountServiceAccountToken set to true globally or on sensitive pods. The tester gains remote code execution inside a pod running with a high-privilege service account token. How can they use this token against the Kubernetes API?

Question 58mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an Azure penetration test, an attacker identifies an Azure Function with an HTTP trigger that uses function-level keys. However, the function key was leaked in a public GitHub repository. What level of access does this key provide?

Question 59hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is evaluating a Kubernetes environment and discovers that the Kubernetes dashboard is deployed with cluster-admin privileges and is exposed to the internet via a NodePort service without authentication. How can this be exploited?

Question 60easymulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

An auditor is reviewing an AWS cloud environment and identifies several common misconfigurations related to identity and access management. Which TWO of the following practices represent significant security risks? (Choose TWO)

Question 61mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

During a penetration test of an Azure Active Directory tenant, an attacker identifies multiple security misconfigurations. Which TWO of the following techniques represent common Azure AD attack vectors or misconfigurations? (Choose TWO)

Question 62easymulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

An auditor is evaluating cloud storage security across multiple cloud providers. Which TWO of the following settings indicate improper security configurations for cloud storage buckets? (Choose TWO)

Question 63mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an Azure subscription review, a security assessor checks for role-based access control and resource configuration best practices. Which TWO of the following findings represent high-severity security risks? (Choose TWO)

Question 64easymulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

An auditor reviews network security configurations in an AWS VPC. Which TWO of the following network configurations represent potential security risks? (Choose TWO)

Question 65easymulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

An auditor reviews cloud logging and monitoring configurations across an enterprise multi-cloud environment. Which TWO of the following practices represent critical security deficiencies? (Choose TWO)

Question 66mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

During a Kubernetes cluster security assessment, a penetration tester identifies multiple misconfigurations. Which TWO of the following findings represent high-risk security flaws in Kubernetes RBAC and cluster setup? (Choose TWO)

Question 67easymulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

An auditor reviews an enterprise's hybrid cloud identity architecture. Which TWO of the following configurations represent insecure identity practices? (Choose TWO)

Question 68mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

During an AWS security review, a penetration tester identifies several identity and storage policies. Which TWO of the following configurations are considered insecure? (Choose TWO)

Question 69easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is auditing an AWS environment and discovers that an IAM role used by an EC2 instance has an overly permissive trust policy allowing any principal in an external AWS account to assume it without specifying an ExternalId. What is the standard security term and remediation for this vulnerability?

Question 70mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is analyzing an Azure environment and discovers that an Azure Function App has been configured with managed identity enabled and possesses 'Contributor' access to the subscription. The function code contains a Server-Side Request Forgery (SSRF) vulnerability. How can the tester exploit the Azure Instance Metadata Service (IMDS) via this SSRF to elevate privileges?

Question 71easymulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

When reviewing container security and Kubernetes cluster configurations, which THREE practices or misconfigurations commonly lead to container escapes or host compromise? (Choose three)

Question 72mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a Microsoft 365 tenant and discovers that a global administrator account has no multi-factor authentication (MFA) enforcement. The tester wants to exploit this to gain persistent access to the tenant's email and files. Which Azure AD feature, if misconfigured, would allow the attacker to maintain access even after the initial password is changed?

Question 73hardmultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During a penetration test of a Microsoft Azure environment, a tester obtains a managed identity token for a virtual machine. The token has permissions to read secrets from an Azure Key Vault. Which technique can the tester use to escalate privileges by leveraging the Key Vault access?

Question 74easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is evaluating a Google Cloud Platform (GCP) environment and discovers a service account key file stored in a public Cloud Storage bucket. The service account has the roles/editor role on the project. What is the most direct way for the tester to leverage this key to gain unauthorized access to the project's resources?

Question 75mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a Microsoft Azure environment and discovers that a virtual machine (VM) has a system-assigned managed identity enabled. The VM is running a web application that is vulnerable to server-side request forgery (SSRF). The tester wants to exploit the SSRF to gain access to Azure resources. Which TWO of the following actions can the tester perform to leverage the managed identity? (Choose two.)

Question 76mediummultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

During a CPENT engagement against a Microsoft 365 tenant, you obtain a low-privileged user's credentials and successfully authenticate. You need to determine whether the tenant has enabled Security Defaults or configured custom Conditional Access policies, because this affects your ability to perform password spraying and legacy authentication attacks. Which Microsoft Graph endpoint should you query to retrieve the tenant's Conditional Access policy configuration?

Question 77mediummulti select

Read the full Cloud And Hybrid Infrastructure Security explanation →

A CPENT tester is targeting a hybrid cloud environment that uses AWS IAM Identity Center (successor to AWS Single Sign-On) to federate with an on-premises Active Directory. The tester has obtained read-only access to the AWS Organizations management account. Which TWO actions should the tester perform to enumerate potential privilege escalation paths into member accounts? (Choose two.)

Question 78easymultiple choice

Read the full Cloud And Hybrid Infrastructure Security explanation →

A penetration tester is assessing a Microsoft Azure environment and finds that a virtual machine has a system-assigned managed identity. The tester has obtained a shell on the VM and wants to use the managed identity to access an Azure Key Vault. Which endpoint should the tester query to obtain an access token for the Key Vault?