CPENT Cloud And Hybrid Infrastructure Security Practice Test 3 — 15 Questions

Question 1

A penetration tester is assessing a hybrid cloud environment that uses Azure AD Connect with Password Hash Synchronization (PHS) to synchronize on-premises Active Directory with Azure AD. The tester has compromised an on-premises workstation and obtained the credentials of a user who is a member of the 'Azure AD Connect Sync' group. The tester wants to escalate privileges to Azure AD Global Administrator. Which of the following actions would BEST achieve this goal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the synchronization rules on the Azure AD Connect server to include a custom attribute that sets the password of a target Azure AD account to a known value.. Members of the 'Microsoft Entra Connect Sync' group can manage the AD Connect server, including its synchronization rules. By creating a custom rule that maps an attribute to the password field, an attacker can reset the password of a privileged Microsoft Entra ID account, such as a Global Administrator. This is a known attack technique that abuses the synchronization process. The other options either require additional permissions, do not directly grant Microsoft Entra ID access, or cause disruption without escalation.

Answer

Use the compromised user's credentials to access the Azure AD Connect server and run the 'Set-ADSyncScheduler' cmdlet to disable password hash synchronization, causing a denial of service.

Answer

Perform a DCSync attack using the compromised user's credentials to retrieve the password hash of the on-premises domain administrator and then use it to access Azure AD.

Answer

Use the compromised user's credentials to log into the Azure AD Connect server and extract the credentials of the Azure AD connector account from the ADSync database.

Question 2

You are conducting a CPENT assessment of a hybrid environment where an on-premises Active Directory connects to Microsoft Entra ID via Microsoft Entra Connect. You compromise a workstation and recover the credentials of the Entra Connect synchronization account (MSOL_ or ADSync). Which attack path should you prioritize to escalate to full tenant compromise?

Accepted Answer

Use the synchronization account to reset the password of a hybrid identity that holds the Global Administrator role in Entra ID.. The ADSync account has directory replication and synchronization rights that allow it to modify attributes of synchronized users. By resetting the password of a hybrid identity that holds an Entra ID administrative role, the new credential is written on-premises and then synchronized to Entra ID, granting cloud access. Directly modifying the sync configuration or creating on-premises admins does not yield tenant-level control.

Answer

Use the synchronization account to create a new on-premises user and assign it the Enterprise Admins group, then wait for synchronization.

Answer

Use the synchronization account to modify the Azure AD Connect configuration and enable password hash synchronization for all users.

Answer

Use the synchronization account to perform a DCSync against the on-premises domain controller and extract the KRBTGT hash.

Question 3

During an authorized penetration test of a company's Microsoft 365 tenant, you compromise a standard user account that has no administrative roles. You need to identify all SharePoint Online sites the user can access, then attempt to escalate privileges by abusing a misconfigured sharing link. Which Microsoft Graph API permission scope would allow you to enumerate the sites the user can access without requiring tenant-wide admin consent?

Accepted Answer

Sites.Read (delegated). The delegated Sites.Read scope is designed for user-context access to SharePoint sites and does not require tenant-wide admin consent. It allows the signed-in user to enumerate sites they have permission to see, which matches the goal of identifying accessible sites from a compromised standard account. Broader scopes like Sites.Read.All or Sites.ReadWrite.All typically need admin consent, making them unusable in this scenario.

Answer

Sites.Read.All

Answer

Sites.Read.All (delegated)

Answer

Sites.ReadWrite.All

Question 4

A penetration tester is assessing a hybrid cloud environment that uses Azure AD Connect with Password Hash Synchronization (PHS) to synchronize on-premises Active Directory with Azure AD. The tester has compromised an on-premises workstation and obtained the credentials of a user who is a member of the 'Azure AD Connect Sync' group. The tester wants to escalate privileges to Azure AD Global Administrator. Which of the following actions would BEST achieve this goal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Abuse Azure AD Connect service account's directory synchronization permissions to add a new federated domain or modify federation settings. The Microsoft Entra Connect service account is granted the Directory Synchronization Accounts role in Microsoft Entra ID, which allows it to manage directory synchronization and federation configuration. By abusing these permissions, an attacker can add a new federated domain or alter federation settings to point to a controlled identity provider, effectively allowing them to authenticate as any user in the tenant and escalate privileges. This technique is known as federation backdoor or golden SAML attack.

Answer

Azure AD Connect Seamless SSO computer account exploitation

Answer

Password Hash Synchronization (PHS) account takeover

Answer

Golden Ticket attack against Azure AD

Question 5

A penetration tester is conducting an assessment of a Kubernetes cluster hosted on Google Kubernetes Engine (GKE). The tester has compromised a pod that runs with a service account token mounted. Which TWO of the following actions could the tester perform to escalate privileges within the cluster? (Choose two.)

Accepted Answer

Use the service account token to query the Kubernetes API server for secrets in the cluster. In a compromised pod, the mounted service account token can be used to interact with the Kubernetes API server. If the service account has permissions to read secrets, the tester can extract sensitive data, including other tokens. If it can create pods, the tester can launch a new pod with a more privileged service account to escalate privileges. Both actions depend on the RBAC permissions assigned to the compromised service account.

Answer

Use the token to access the GKE control plane's dashboard without authentication

Answer

Modify the cluster's RBAC policies to grant the current service account cluster-admin privileges

Answer

Access the GKE metadata server to retrieve node credentials

Question 6

An auditor finds an Amazon S3 bucket configured with public read access enabled via an Access Control List (ACL), but the bucket policy explicitly denies public read access. How does AWS evaluate these conflicting permissions?

Accepted Answer

The explicit Deny in the bucket policy takes precedence, resulting in access being denied.. AWS evaluates all applicable policies (identity-based, resource-based, ACLs, SCPs, permission boundaries) together, and any explicit Deny anywhere in the evaluation chain overrides every Allow. Because the bucket policy contains an explicit Deny for public read, that Deny wins over the ACL's public-read grant, and the request is denied. This is the fundamental 'explicit deny always wins' rule in AWS IAM policy evaluation logic.

Answer

AWS generates a configuration error and blocks all traffic until the conflict is resolved manually.

Answer

Access is granted because any Allow permission supersedes bucket restrictions.

Answer

The public ACL takes precedence because ACLs are evaluated before bucket policies.

Question 7

A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?

Accepted Answer

Leveraging the cgroups release_agent notification mechanism to execute arbitrary commands on the host operating system.. With CAP_SYS_ADMIN and a read-write cgroup v1 mount, the attacker can write a path to the release_agent file and then trigger a cgroup release, causing the kernel to execute that path as root in the host's initial namespace. This is the canonical cgroup v1 container escape (CVE-2022-0492 is a related kernel-side variant). No other listed vector is available from inside a standard container without additional host misconfigurations.

Answer

Writing directly to the host's /etc/passwd file via a shared memory segment mounted at /dev/shm.

Answer

Using the ptrace system call to inject code into the host's systemd daemon process.

Answer

Issuing a mount command to repartition the host's primary storage block device.

Question 8

A penetration tester is evaluating an AWS environment and discovers that an IAM role attached to an Amazon EC2 instance has an overly permissive trust policy allowing any user in the account to assume it via the sts:AssumeRole API without external conditions. Which specific remediation step should the cloud administrator apply to fix this risk?

Accepted Answer

Modify the IAM role trust policy to include a Condition block restricting the principal or requiring multi-factor authentication.. The overly permissive trust policy allows any user in the account to assume the role, which is a significant risk. The remediation is to modify the trust policy to include a Condition block that restricts the principal (e.g., specific IAM users or roles) or requires multi-factor authentication. This ensures that only authorized entities can assume the role, following the principle of least privilege.

Answer

Rotate the AWS account root user access keys immediately.

Answer

Attach an explicit Deny policy to the EC2 instance metadata service version 2 configuration.

Answer

Disable the AWS Security Token Service endpoint globally across the AWS organization.

Question 9

In a hybrid enterprise environment, an organization uses Azure AD Seamless Single Sign-On (Seamless SSO). During a penetration test, an attacker compromises a domain-joined workstation and attempts to abuse Seamless SSO. What is the mechanism by which Seamless SSO authenticates users, and what is a known security consideration?

Accepted Answer

It uses a computer account (AZUREADSSOACC$) in on-premises AD to generate Kerberos tickets for users authenticating to cloud services via browser redirection.. Seamless SSO uses a computer account named AZUREADSSOACC$ in on-premises AD whose Kerberos decryption key is shared with Microsoft Entra ID. When a user on a domain-joined machine accesses a Microsoft 365 resource, the browser is redirected to Microsoft Entra ID, which returns a Kerberos challenge; the local machine requests a service ticket for AZUREADSSOACC$ from the on-prem DC, and the browser presents it to Microsoft Entra ID, which decrypts it with the shared key to authenticate the user without re-entering credentials.

Answer

It requires all users to store their plaintext Active Directory passwords in Azure Key Vault.

Answer

It bypasses all Conditional Access policies for users connecting from corporate networks.

Answer

It forces the domain controllers to export NTLMv1 hashes to the Azure cloud directory.

Question 10

An auditor reviews an Azure storage account and notes that 'Secure transfer required' is set to Disabled. What security risk does this misconfiguration introduce?

Accepted Answer

Data in transit between clients and the storage account can be intercepted over unencrypted HTTP connections.. Disabling secure transfer allows unencrypted HTTP connections to the storage account, enabling potential Man-in-the-Middle (MitM) attacks to intercept data in transit.

Answer

Storage account access keys are transmitted in plaintext during Azure Resource Manager API calls.

Answer

Shared Access Signatures (SAS) tokens expire immediately upon generation.

Answer

Blob storage data at rest is stored without AES-256 encryption.

Question 11

During an assessment of a Google Cloud Platform (GCP) environment, a penetration tester finds a Compute Engine instance with default service account credentials and scopes set to https://www.googleapis.com/auth/cloud-platform. What security implication does this broad scope present?

Accepted Answer

The service account possesses permissions across all GCP services unless explicitly restricted by IAM project-level bindings.. The scope https://www.googleapis.com/auth/cloud-platform is the broadest OAuth scope available in GCP, granting the service account access to essentially all GCP APIs. IAM bindings then determine which specific actions the account can actually perform, but the scope itself does not restrict the API surface. Therefore, the service account can potentially reach every GCP service unless IAM policies explicitly deny or limit permissions.

Answer

Google Cloud automatically rotates the service account private key every 60 seconds.

Answer

The instance is automatically accessible via SSH from any external IP address without firewall rules.

Answer

The instance metadata server disables access tokens to prevent Server-Side Request Forgery.

Question 12

A security engineer discovers that an AWS IAM user has an active access key and permissions to run ec2:RunInstances, iam:PassRole, and iam:CreateRole. What privilege escalation path does this permission combination represent?

Accepted Answer

The user can launch a new EC2 instance and attach a privileged IAM role via iam:PassRole, then access the instance to obtain temporary security credentials.. The combination of ec2:RunInstances, iam:PassRole, and iam:CreateRole allows a user to launch an EC2 instance with an attached IAM role that has higher privileges. By passing a privileged role to the instance (iam:PassRole), the user can then access the instance (e.g., via SSH or SSM) and retrieve temporary credentials from the instance metadata, effectively escalating privileges. The iam:CreateRole permission can be used to create a new role with elevated permissions if needed.

Answer

The user can modify the trust policy of the root user account using iam:CreateRole.

Answer

The user can inject malicious code into the AWS Nitro Enclave hypervisor layer.

Answer

The user can escalate privileges by updating their own MFA device via the EC2 metadata service.

Question 13

An AWS penetration tester discovers that an Amazon RDS database instance has the 'Publicly Accessible' flag set to true, and its security group allows inbound traffic from 0.0.0.0/0 on port 3306. What is the immediate risk, and what is the recommended control?

Accepted Answer

The database can be reached from the internet; the security group should be restricted to trusted CIDR blocks and public accessibility disabled.. The database is exposed to the public internet, requiring network ACLs, security group restriction, and disabling public accessibility.

Answer

S3 bucket policies will automatically override database access controls.

Answer

The database is vulnerable to container escape via Docker socket exposure.

Answer

IAM role trust policies are bypassed by external SQL injection attacks.

Question 14

A penetration tester is analyzing a Kubernetes deployment where a ClusterRole grants the verbs get, list, and watch on secrets, combined with a ClusterRoleBinding assigning this to a default service account in a public-facing namespace. How can an external attacker exploit this configuration?

Accepted Answer

By exploiting an application vulnerability to obtain the service account token, then querying the Kubernetes API to dump all cluster-wide secrets.. A ClusterRole granting get/list/watch on secrets, bound cluster-wide to a service account in a public namespace, means any holder of that SA token can read every secret in every namespace via the API server. An external attacker who exploits an application vulnerability (e.g., SSRF, RCE, or a leaked token) to obtain the mounted service account token can then call the Kubernetes API with that bearer token and dump cluster-wide secrets, including database credentials, TLS keys, and other service account tokens.

Answer

By executing a kernel-level exploit against the etcd database directly from outside the cluster.

Answer

By generating a self-signed certificate authority to impersonate the kube-apiserver.

Answer

By performing a DNS poisoning attack against CoreDNS to redirect authentication tokens.

Question 15

During an Azure assessment, an attacker discovers that an App Service web application has Managed Identity enabled and the underlying application code is vulnerable to Server-Side Request Forgery (SSRF). How can the attacker chain these vulnerabilities?

Accepted Answer

By using the SSRF vulnerability to query the Azure Instance Metadata Service (IMDS) and retrieve access tokens for the Managed Identity.. An attacker exploiting SSRF can query the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254 to acquire OAuth access tokens for the managed identity.

Answer

By extracting the plaintext storage account keys from the kudu SCM debug console logs.

Answer

By forcing the App Service to downgrade its TLS version to SSLv3.

Answer

By injecting malicious PowerShell commands into the Azure Active Directory synchronization pipe.