CPENT Cloud And Hybrid Infrastructure Security Practice Test 2 — 15 Questions

Question 1

A penetration tester is assessing an advanced hybrid cloud and Kubernetes infrastructure. Which THREE of the following scenarios represent critical architecture or configuration flaws? (Choose THREE)

Accepted Answer

Exposing the Kubernetes etcd database port (2379) directly to the public internet without mutual TLS authentication.. Option C is correct because etcd on port 2379 stores all cluster state including Secrets, and exposing it to the internet without mutual TLS (client cert authentication) allows unauthenticated read/write access, enabling full cluster compromise. Option E is correct because ConfigMaps are stored unencrypted in etcd and are readable by anyone with get/list on configmaps, so plaintext database credentials leak; Secrets (ideally with encryption at rest) or an external secret store such as Vault is required. The option marked with null (Configuring admission webhook servers without validating TLS certificates or securing webhook endpoints) is correct because ValidatingWebhookConfiguration and MutatingWebhookConfiguration endpoints that skip CA bundle validation or use insecure TLS permit MITM tampering and can block or bypass admission control, breaking the cluster's policy enforcement. Option A does not belong because enabling TLS for intra-pod and kubelet communication is a hardening best practice, not a flaw. Option B does not belong because enabling audit logs and shipping them to a SIEM improves detection and forensics. Option D does not belong because RBAC with narrowly scoped roles for service accounts follows least privilege and is a recommended configuration.

Answer

Enabling TLS encryption for all intra-pod and kubelet communications.

Answer

Enabling Kubernetes audit logs and exporting them to a secure SIEM platform.

Answer

Using RBAC authorization mode with narrowly scoped roles for all cluster service accounts.

Question 2

During an assessment of a hybrid Active Directory environment, a penetration tester compromises an on-premises user account that is synchronized to Azure AD via Azure AD Connect. The tester notices that the on-premises account is a member of the local 'Backup Operators' group. Which hybrid attack path is most directly enabled by this configuration?

Accepted Answer

The tester can exploit local file read privileges associated with Backup Operators to access the NTDS.dit file, enabling offline hash extraction and subsequent synchronization abuse.. Members of the 'Backup Operators' group in Active Directory have local rights to read file contents, but more importantly, in hybrid environments with Microsoft Entra Connect, accounts with specific local privileges or DCSync rights can sometimes be leveraged, or more specifically, the synchronization allows credential abuse. However, Backup Operators can read the NTDS.dit file or abuse local file access. Wait, specifically for Microsoft Entra Connect, the service account or synchronized accounts can sometimes lead to Microsoft Entra ID takeover if password hashes can be synchronized or if the Microsoft Entra Connect server itself is compromised. Let's look at the options.

Answer

The tester can execute an Azure Seamless Single Sign-On ticket-forgery attack directly from the local workstation.

Answer

The tester can extract the plaintext credentials of the Azure AD Connect sync account stored improperly in the registry by Backup Operators.

Answer

The tester can directly use DCSync against the Azure AD Graph API to extract cloud-only administrative password hashes.

Question 3

An organization stores sensitive application backups in an Amazon S3 bucket. During a cloud penetration test, the tester finds that the S3 bucket policy explicitly allows 's3:GetObject' to '*' without any AWS:SourceIp or aws:SourceArn conditions, but the bucket is marked with 'Block Public Access' enabled at the account level. What is the impact of this configuration?

Accepted Answer

Public access is successfully blocked because S3 Account-level Block Public Access settings override individual bucket policies.. The account-level Block Public Access (BPA) setting is a preventive control that overrides any bucket policy granting public access. Even though the bucket policy allows s3:GetObject to '*', the account-level BPA setting blocks any public access by rejecting requests that would be public. Therefore, the bucket remains private and the policy has no effect for anonymous users.

Answer

Anyone on the internet can read the objects because the bucket policy takes precedence over account settings.

Answer

An error occurs during S3 bucket creation, preventing the policy from being applied.

Answer

The bucket becomes completely inaccessible even to internal authenticated AWS IAM users.

Question 4

A penetration tester is performing a container escape on a Kubernetes cluster. The tester gains remote code execution inside a pod and discovers that the container is running with privileged mode disabled, but the service account token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token has permissions to create new Pods using the cluster-admin cluster role. Which kubectl command or API call pattern should the tester use to achieve a container escape to the underlying host?

Accepted Answer

Create a pod specification with 'hostNetwork: true' and a 'hostPath' volume mounting '/' from the node to the container, then execute 'chroot /host' inside the new pod.. With a token that can create pods under cluster-admin, the standard escape is to schedule a new pod that mounts the node's root filesystem via a hostPath volume and runs privileged or with hostPID/hostNetwork, then chroot into /host to operate as root on the node. This leverages Kubernetes' own scheduling to place the pod on a node and break out of the container boundary using the host mount.

Answer

Execute 'kubectl exec -it' using the token to attach to the kube-apiserver directly and modify the container runtime socket.

Answer

Modify the local /etc/shadow file inside the container to grant root access to the node kernel.

Answer

Send a malicious payload to the container runtime socket at /var/run/docker.sock to trigger a runC vulnerability.

Question 5

During a container security assessment, a penetration tester identifies a Kubernetes pod running with 'CAP_SYS_ADMIN' capabilities and the host's PID namespace shared ('hostPID: true'). Which technique allows the tester to escape the container and execute code on the host?

Accepted Answer

Use 'nsenter --target 1 --mount --uts --ipc --net --pid' to enter the host's namespaces and spawn a root shell on the host node.. With CAP_SYS_ADMIN and hostPID enabled, the tester can inspect processes running on the host, locate processes like systemd or docker daemon, and use tools like nsenter or inject payloads into host namespaces.

Answer

Mount the Docker socket inside the container using the mount syscall enabled by CAP_SYS_ADMIN.

Answer

Execute the 'docker run' command inside the container to spin up a sibling container.

Answer

Write directly to the host's /proc/sysrq-trigger file without any additional mounts.

Question 6

A penetration tester is reviewing an Azure Active Directory (Azure AD) tenant and finds that user writeback and device writeback are enabled in Azure AD Connect, but the service account lacks appropriate permissions in on-premises Active Directory. What security risk does misconfigured Azure AD Connect writeback pose?

Accepted Answer

If compromised, cloud-based attackers could potentially manipulate synchronized objects or abuse writeback channels to affect on-premises Active Directory integrity.. Writeback features in Microsoft Entra Connect (password, device, and group writeback) create a bidirectional trust path: changes made in the cloud can be pushed back into on-premises AD. If the AD DS Connector account is over-privileged or the writeback channel is abused, a cloud-side compromise can be leveraged to modify synchronized objects, create rogue objects, or otherwise tamper with on-premises directory integrity.

Answer

It automatically grants all Azure AD users Domain Admin privileges on the on-premises domain controllers.

Answer

It allows cloud-only users to bypass conditional access policies by syncing fake device objects.

Answer

It exposes the Azure AD global administrator password in plaintext via the Active Directory Recycle Bin.

Question 7

A penetration tester is auditing an AWS environment and investigating potential privilege escalation paths via IAM. Which TWO of the following IAM permission combinations represent classic privilege escalation vectors in AWS? (Choose two)

Accepted Answer

iam:CreatePolicyVersion combined with iam:SetDefaultPolicyVersion. Option A is correct because iam:CreatePolicyVersion lets an attacker create a new version of an existing managed policy with arbitrary permissions, and iam:SetDefaultPolicyVersion then makes that malicious version the active one, effectively granting themselves or others elevated privileges without needing iam:AttachUserPolicy. Option E is correct because iam:PassRole combined with ec2:RunInstances allows the attacker to launch an EC2 instance with a more privileged role attached, then retrieve that role's temporary credentials from the instance metadata service (IMDS) and escalate privileges. Option B is not a classic escalation path because invoking a function or creating a function URL does not by itself grant additional IAM permissions. Option C is not an escalation vector because s3:PutBucketPolicy and s3:GetObject only affect S3 data access, not IAM privilege boundaries. Option D is not a standard escalation combination because iam:CreateAccessKey creates keys for the calling user (or a user they can already modify), and iam:PutUserPolicy alone does not let an attacker attach policies to a higher-privileged user without additional permissions like iam:AttachUserPolicy or iam:PassRole.

Answer

lambda:InvokeFunction and lambda:CreateFunctionUrl

Answer

s3:PutBucketPolicy and s3:GetObject

Answer

iam:CreateAccessKey and iam:PutUserPolicy

Question 8

During a hybrid cloud assessment, a penetration tester discovers that an organization uses Azure Arc to manage on-premises Windows servers. Which THREE security risks or attack vectors are associated with a compromised Azure Arc Connected Machine Agent (azcmagent) on an on-premises server? (Choose three)

Accepted Answer

The attacker can utilize the established communication channel (outbound HTTPS port 443) to maintain persistent command and control (C2) mimicking legitimate Azure management traffic.. Option A is correct because the Azure Arc Connected Machine Agent (azcmagent) maintains an outbound HTTPS (port 443) connection to Azure management endpoints, so an attacker who compromises the agent can tunnel C2 traffic through that legitimate-looking channel to blend in with normal Azure management traffic. Option B is correct because Arc-enabled servers expose a local Azure Instance Metadata Service (IMDS) endpoint that can be queried to obtain OAuth access tokens tied to the server's managed identity, enabling the attacker to authenticate to Azure resources. Option D is correct because the Azure Arc extension framework (HybridCompute agent) allows extensions and scripts to be pushed and executed on the host, so a compromised agent can be abused to deploy arbitrary malicious extensions or scripts for code execution. Option C is not correct because DCSync targets Active Directory domain controllers to replicate credentials such as the krbtgt hash, and Azure Arc does not provide a path to perform DCSync against Microsoft Entra Connect or extract a cloud tenant's krbtgt hash. Option E is not correct because Azure Arc does not convert an on-premises Active Directory domain into Microsoft Entra Domain Services, nor does compromising azcmagent bypass Group Policy Objects in that manner.

Answer

The attacker can directly perform a DCSync attack against Azure AD Connect to extract thekrbtgt hash of the cloud tenant.

Answer

The attacker can bypass on-premises Group Policy Objects (GPOs) entirely by converting the local Active Directory domain into an Azure AD Domain Services instance.

Question 9

A penetration tester is assessing an AWS environment and discovers an EC2 instance with an attached IAM role that has permissions to call sts:AssumeRole. The tester also finds that the role's trust policy allows any principal in the same account to assume it. Which attack technique can the tester use to escalate privileges within the account?

Accepted Answer

Use the instance's role to assume a more privileged role that trusts the instance role, potentially gaining administrative access.. The trust policy allows any principal in the account to assume the role, and the instance role has sts:AssumeRole permission. This combination enables the tester to assume a more privileged role, escalating privileges. This is a common misconfiguration in AWS where roles are overly trusting.

Answer

Retrieve the instance's IAM role credentials from the EC2 instance metadata service and use them to create a new IAM user with full permissions.

Answer

Modify the instance's IAM role trust policy to allow the tester's external AWS account to assume it, then assume the role from the external account.

Answer

Use the instance's role to call sts:GetSessionToken and obtain long-term credentials that can be used to access the AWS Management Console.

Question 10

A penetration tester is analyzing an AWS environment and finds an EC2 instance with an attached IAM role that has the permissions ec2:DescribeInstances, ec2:CreateTags, and iam:PassRole. The role also has a trust relationship allowing the EC2 service to assume it. The tester wants to escalate privileges by launching a new EC2 instance with an existing high-privileged role. Which sequence of AWS CLI commands would achieve this?

Accepted Answer

aws ec2 run-instances --image-id ami-12345678 --instance-type t2.micro --iam-instance-profile Arn=arn:aws:iam::123456789012:instance-profile/HighPrivRole. With iam:PassRole and ec2:RunInstances, an attacker can launch a new EC2 instance and attach an existing instance profile that has higher privileges. Once the instance is running, the attacker can access it and retrieve temporary credentials from the Instance Metadata Service (IMDS). These credentials can then be used to perform actions as the high-privileged role, effectively escalating privileges within the AWS account.

Answer

aws ec2 modify-instance-attribute --instance-id i-1234567890abcdef0 --iam-instance-profile Arn=arn:aws:iam::123456789012:instance-profile/HighPrivRole

Answer

aws iam create-role --role-name NewRole --assume-role-policy-document file://trust.json then aws ec2 run-instances --image-id ami-12345678 --instance-type t2.micro --iam-instance-profile Name=NewRole

Answer

aws ec2 run-instances --image-id ami-12345678 --instance-type t2.micro --iam-instance-profile Name=HighPrivRole

Question 11

A penetration tester is assessing a hybrid cloud environment that uses Azure AD Connect to synchronize on-premises Active Directory with Azure AD. The tester has obtained credentials for a synchronized user account that has the password hash synchronized to Azure AD. Which TWO of the following attacks can the tester perform to move laterally or escalate privileges in the cloud environment? (Choose two.)

Accepted Answer

Abuse Azure AD Connect credentials to extract on-premises hashes. Password spraying against Microsoft Entra ID with a known synchronized password can compromise other accounts if users reuse passwords or have weak credentials. Additionally, compromising the Microsoft Entra Connect server can yield credentials that allow access to on-premises Active Directory, enabling lateral movement. Both attacks leverage the hybrid identity synchronization to bridge cloud and on-premises environments.

Answer

Pass-the-Hash against Azure AD integrated resources

Answer

Kerberoasting against Azure AD service principals

Answer

Golden Ticket attack against Azure AD

Question 12

A penetration tester is assessing a hybrid cloud environment where on-premises Active Directory is synchronized with Azure AD using Azure AD Connect. The tester compromises an on-premises user account that has the 'Password Reset' permission on a user object in Active Directory. Which attack can the tester perform to escalate privileges in Azure AD?

Accepted Answer

Use the compromised account to reset the password of an on-premises user who is synchronized to Azure AD, then use the new password to authenticate to Azure AD and access resources.. The on-premises account can reset the password of a synchronized user. Since password changes synchronize to Microsoft Entra ID, the tester can then authenticate to Microsoft Entra ID as that user. If the user has higher privileges in Microsoft Entra ID, this escalates access. This is a known hybrid identity attack path.

Answer

Extract the Azure AD Connect synchronization account credentials from the on-premises server and use them to directly modify objects in Azure AD.

Answer

Use the compromised account to add a new federated domain to Azure AD, then create a new user in that domain with administrative privileges.

Answer

Modify the on-premises user's attributes to include an alternate UPN suffix that matches an Azure AD administrator, then authenticate to Azure AD with the modified UPN.

Question 13

A penetration tester is assessing a Google Cloud Platform (GCP) organization. During enumeration, the tester discovers that the default Compute Engine service account is enabled and attached to all newly created virtual machine instances. The tester also finds that the service account has the Editor role at the project level. What is the MOST likely privilege escalation path an attacker could exploit?

Accepted Answer

Use the default service account to modify the project's IAM policy and grant the attacker's user account the Owner role.. The default Compute Engine service account with the Editor role at the project level can modify IAM policies because Editor includes resourcemanager.projects.setIamPolicy. An attacker who compromises an instance using this service account can escalate privileges by granting their own account Owner. This is a critical misconfiguration because the default service account should have minimal permissions, and Editor is overly permissive. The other options either require permissions not granted by Editor or are specific to GKE environments.

Answer

Use the default service account to access the Compute Engine metadata server and retrieve the kube-env variable to obtain Kubernetes credentials.

Answer

Use the default service account to create a new VM instance with a startup script that adds the attacker's SSH key to the instance metadata.

Answer

Use the default service account to impersonate a more privileged service account by leveraging the iam.serviceAccounts.actAs permission on a high-privilege service account.

Question 14

A penetration tester is performing a security assessment of a hybrid cloud environment that uses Microsoft Azure AD Connect to synchronize on-premises Active Directory with Azure Active Directory. The tester gains access to the on-premises network and discovers that the Azure AD Connect server is configured with the Password Hash Synchronization (PHS) feature. The tester also finds that the AD Connect service account has the 'Replicate Directory Changes' permission on the domain. What is the MOST effective attack to obtain credentials for privileged Azure AD accounts?

Accepted Answer

Extract the credentials stored by Azure AD Connect on the server, which include the credentials of the AD DS connector account and the Azure AD connector account.. Microsoft Entra Connect stores connector account credentials locally, and an attacker with administrative access to the AD Connect server can extract them. The Microsoft Entra ID connector account has permissions to modify Microsoft Entra ID, allowing the attacker to create or modify cloud accounts, reset passwords, or assign roles. This is more direct than attacking on-premises AD, as it targets the hybrid link. The other options either require additional permissions, target the wrong credential store, or are not applicable to the described configuration.

Answer

Perform a Kerberoasting attack against the AD Connect service account to obtain a service ticket and crack its password offline.

Answer

Use the AD Connect service account to perform a DCSync attack and retrieve the password hashes of all domain users, including those synchronized to Azure AD.

Answer

Extract the password hashes from the on-premises Active Directory database (ntds.dit) using Volume Shadow Copy and crack them offline.

Question 15

A penetration tester is evaluating an Amazon Web Services (AWS) environment and discovers that an Amazon S3 bucket has been configured with a bucket policy that allows public read access to all objects. The bucket contains sensitive customer data. The tester wants to demonstrate the impact of this misconfiguration. Which of the following commands would the tester use to list the contents of the bucket without authentication?

Accepted Answer

aws s3 ls s3://bucket-name --no-sign-request. The correct command is 'aws s3 ls s3://bucket-name --no-sign-request' because it allows listing the bucket contents without authentication when the bucket policy permits public read. This directly demonstrates the exposed data. The other commands either require authentication, retrieve different information, or use a different service that does not support unsigned requests in the same way. The tester should use the command that clearly shows unauthenticated access.

Answer

aws s3api list-objects --bucket bucket-name --query 'Contents[].Key'

Answer

aws s3api get-bucket-acl --bucket bucket-name

Answer

aws s3 cp s3://bucket-name/object.txt . --recursive