CPENT Cloud And Hybrid Infrastructure Security Practice Test 2 — 15 Questions

Question 1

A penetration tester is analyzing a Kubernetes deployment where a ClusterRole grants the verbs get, list, and watch on secrets, combined with a ClusterRoleBinding assigning this to a default service account in a public-facing namespace. How can an external attacker exploit this configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

By exploiting an application vulnerability to obtain the service account token, then querying the Kubernetes API to dump all cluster-wide secrets.. If the namespace is exposed or pods running the default service account are compromised via an RCE vulnerability, the attacker can harvest sensitive application secrets across the entire cluster.

Answer

By executing a kernel-level exploit against the etcd database directly from outside the cluster.

Answer

By generating a self-signed certificate authority to impersonate the kube-apiserver.

Answer

By performing a DNS poisoning attack against CoreDNS to redirect authentication tokens.

Question 2

During an Azure assessment, an attacker discovers that an App Service web application has Managed Identity enabled and the underlying application code is vulnerable to Server-Side Request Forgery (SSRF). How can the attacker chain these vulnerabilities?

Accepted Answer

By using the SSRF vulnerability to query the Azure Instance Metadata Service (IMDS) and retrieve access tokens for the Managed Identity.. An attacker exploiting SSRF can query the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254 to acquire OAuth access tokens for the managed identity.

Answer

By extracting the plaintext storage account keys from the kudu SCM debug console logs.

Answer

By forcing the App Service to downgrade its TLS version to SSLv3.

Answer

By injecting malicious PowerShell commands into the Azure Active Directory synchronization pipe.

Question 3

An administrator needs to secure communication between microservices running across different AWS Virtual Private Clouds (VPCs). Which native AWS networking feature provides private connectivity without exposing traffic to the public internet?

Accepted Answer

AWS VPC Endpoints powered by AWS PrivateLink.. AWS VPC Endpoints (powered by AWS PrivateLink) allow private connections between VPCs and AWS services or other VPCs without internet gateways.

Answer

Amazon CloudFront origin access control (OAC).

Answer

AWS Web Application Firewall (WAF) rule groups.

Answer

AWS Identity and Access Management resource-based policies.

Question 4

A penetration tester is evaluating a Kubernetes cluster utilizing Role-Based Access Control (RBAC) and notes that a custom role has the create verb on pods/exec resources. What security risk does this specific permission entail?

Accepted Answer

A user with this permission can execute arbitrary commands inside any running pod in the cluster, leading to potential node or cluster compromise.. The pods/exec permission allows a user to execute commands inside running pods, effectively granting arbitrary code execution in any pod where they can target execution.

Answer

The user can extract the master node's etcd database encryption keys.

Answer

The user can modify the cluster's underlying cloud provider IAM policies.

Answer

The user can bypass network policies by altering iptables rules on the host node.

Question 5

An attacker gains access to an Azure environment and enumerates App Service Configuration settings. They discover that connection strings and database passwords are stored in plaintext within the application settings rather than being referenced via Azure Key Vault references. What attack path does this enable?

Accepted Answer

Any user or service principal with read access to the App Service configuration can extract plaintext database credentials.. Storing secrets in plaintext in App Service configuration settings allows any user or service principal with Reader or Contributor access to the App Service to harvest sensitive credentials.

Answer

The attacker can perform a Golden Ticket attack against the Azure Active Directory Domain Services.

Answer

Azure Firewall automatically terminates the web application due to compliance violations.

Answer

The App Service hypervisor becomes vulnerable to guest-to-host breakout.

Question 6

A penetration tester is assessing an AWS environment where an AWS Lambda function has an execution role with permissions to invoke other Lambda functions and update IAM policies. The function code is vulnerable to command injection. How can this be leveraged for persistence or privilege escalation?

Accepted Answer

Exploit the command injection vulnerability to execute AWS CLI commands using the Lambda execution role, allowing privilege escalation or creation of persistent IAM backdoors.. Command injection in a Lambda function allows an attacker to execute arbitrary commands, using the execution role to modify IAM policies or create new administrative users.

Answer

Trigger a buffer overflow in the AWS Lambda microVM hypervisor to gain root access to the underlying physical server.

Answer

Modify the Lambda function's VPC security group to expose the host kernel to the internet.

Answer

Inject malicious kernel modules into the Lambda execution container.

Question 7

During an AWS penetration test, the tester finds an Amazon API Gateway REST API configured with an AWS_IAM authorizer, but one specific method is mistakenly set to 'Authorization: None' (Open API method). What security risk does this introduce?

Accepted Answer

Unauthenticated clients can invoke the specific API method directly, bypassing the intended AWS IAM signature authentication.. Setting an API Gateway method to Authorization: None bypasses IAM authentication for that specific endpoint, allowing unauthenticated execution of the backend Lambda or HTTP integration.

Answer

AWS WAF will automatically block all traffic to the API Gateway.

Answer

CloudFront distribution logs will fail to record incoming requests.

Answer

The API Gateway becomes vulnerable to SQL injection attacks against its internal DynamoDB storage.

Question 8

An auditor identifies that an organization's Azure storage account allows anonymous public read access to containers and blobs. What configuration change must be applied to remediate this finding?

Accepted Answer

Set the 'Allow Blob public access' property to Disabled on the storage account.. Disabling public blob access on the storage account blocks anonymous requests globally.

Answer

Rotate the primary storage account access key every 24 hours.

Answer

Enable Azure Defender for Storage and configure automatic threat remediation.

Answer

Apply an Azure Firewall rule blocking port 443 inbound to the storage account.

Question 9

A penetration tester is evaluating a hybrid Active Directory environment. They compromise an on-premises user account that has been synchronized to Azure AD. They discover that the on-premises account is a member of a high-privilege local group, but Azure AD Connect has filtered out this group synchronization. How can the tester leverage Azure AD Connect configuration weaknesses?

Accepted Answer

Examine Azure AD Connect synchronization rules and connector filters for misconfigurations or export rules that might inadvertently expose directory objects or allow rule manipulation.. If Azure AD Connect synchronization rules or filtering configurations are misconfigured, attackers can sometimes modify object attributes or take advantage of synchronization sync cycles to escalate privileges.

Answer

Use the Azure AD Connect database password stored in the local SQL Express instance to perform a DCShadow attack.

Answer

Force Azure AD Connect to disable multi-factor authentication for all cloud administrators.

Answer

Inject a malicious DLL into the Azure AD Connect health agent service to execute arbitrary code on the Azure cloud domain controller.

Question 10

A penetration tester is assessing an AWS environment where an EC2 instance is associated with an IAM role that trusts an external third-party AWS account in its trust policy, but the external account ID was mistyped or left overly broad (e.g., condition missing external ID or using an insecure principal). What vulnerability does this introduce?

Accepted Answer

The trusted external account can assume the role, and without an ExternalID condition, it is vulnerable to cross-account confusion or unauthorized assumption.. A misconfigured trust policy trusting an external account without a mandatory ExternalID condition exposes the role to the 'Confused Deputy' problem or unauthorized assumption by actors in the trusted account.

Answer

The EC2 instance is vulnerable to local root privilege escalation via kernel module injection.

Answer

AWS CloudTrail logs for the instance are permanently deleted.

Answer

The third-party account gains direct SSH access to the EC2 instance filesystem.

Question 11

An AWS penetration tester uncovers an IAM policy attached to a user that contains the action 'iam:PutUserPolicy' with a resource of '*'. What privilege escalation vector does this enable?

Accepted Answer

The user can attach an inline policy to their own IAM user granting full administrative access (AdministratorAccess).. An IAM user with iam:PutUserPolicy can attach an inline policy to their own user account or another user, granting themselves full administrative permissions.

Answer

The user can modify the AWS billing dashboard and delete all EC2 instances.

Answer

The user can decrypt all KMS keys in the AWS region.

Answer

The user can delete the AWS account root user credentials.

Question 12

An auditor is reviewing an Azure Kubernetes Service (AKS) cluster and discovers that Role-Based Access Control (RBAC) was disabled during cluster creation, and Azure Active Directory integration is not enabled. What is the primary security consequence?

Accepted Answer

All API requests are treated with full administrative privileges, allowing any compromised pod or user to execute arbitrary cluster-level commands.. Disabling Kubernetes RBAC means all requests to the Kubernetes API server are treated as cluster-admin with anonymous or unauthenticated/wildcard permissions, allowing full cluster compromise.

Answer

Azure Security Center deletes the cluster automatically.

Answer

Pods are automatically restricted from communicating with external IP addresses.

Answer

The AKS cluster control plane is automatically exposed to the public internet on port 22.

Question 13

During an assessment of a Google Cloud Platform project, a penetration tester finds that a Cloud Storage bucket has the allUsers principal granted the Storage Object Viewer role. What security flaw does this represent, and how should it be fixed?

Accepted Answer

The bucket is public; the allUsers or allAuthenticatedUsers IAM binding must be removed to secure the data.. Granting allUsers IAM role bindings on a Cloud Storage bucket makes its objects publicly readable over the internet. Remediation requires removing the allUsers binding.

Answer

The bucket is vulnerable to GCP IAM privilege escalation via service account impersonation.

Answer

Google Cloud Armor automatically deletes the bucket objects.

Answer

Compute Engine instances can no longer mount the bucket as a persistent disk.

Question 14

An Azure penetration tester identifies a Virtual Machine with public IP access that has an incoming Network Security Group (NSG) rule allowing TCP port 3389 (RDP) from any source ('Any' or 'Internet'). What is the recommended remediation?

Accepted Answer

Restrict the NSG rule source IP to trusted administrative networks or implement Azure Bastion for secure management.. Exposing RDP directly to the internet is a high risk; remediation involves restricting the source IP range or using Azure Bastion.

Answer

Disable the Azure Key Vault service across the subscription.

Answer

Enable Azure Active Directory Pass-Through Authentication on the VM guest OS.

Answer

Attach an AWS IAM instance profile to the Azure Virtual Machine.

Question 15

A penetration tester is analyzing a Kubernetes deployment where a ClusterRole grants the verbs get, list, and watch on secrets, combined with a ClusterRoleBinding assigning this to a default service account in a public-facing namespace. How can an external attacker exploit this configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the token in HTTP Authorization Bearer headers to query the Kubernetes API server and inspect or manipulate cluster resources based on the service account's RBAC privileges.. The mounted service account token can be used to authenticate to the Kubernetes API server, allowing the tester to query resources or create malicious pods (e.g., privileged pods) based on the service account's RBAC permissions.

Answer

Convert the token into an Azure AD refresh token using Microsoft Graph API.

Answer

Submit the token to the AWS IAM STS assume-role API to gain root access to the underlying AWS cloud account.

Answer

Inject the token into the Linux kernel keyring to escalate the container to host root privileges.