CPENT Cloud And Hybrid Infrastructure Security Practice Test 3 — 15 Questions

Question 1

An AWS administrator wants to ensure that all data stored in newly created Amazon S3 buckets is automatically encrypted at rest using server-side encryption with customer-managed keys (SSE-KMS). What is the most scalable way to enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure S3 bucket default encryption with SSE-KMS on all buckets or enforce it via AWS Organizations Service Control Policies (SCPs).. Enforcing SSE-KMS via S3 bucket default encryption or AWS Organizations SCPs ensures compliance across accounts and new buckets.

Answer

Manually run an AWS CLI script daily to apply KMS encryption to every individual object.

Answer

Enable AWS Shield Standard on each individual S3 object.

Answer

Attach an Amazon CloudWatch alarm to detect unencrypted PUT requests.

Question 2

During an Azure penetration test, an attacker identifies an Azure Function with an HTTP trigger that uses function-level keys. However, the function key was leaked in a public GitHub repository. What level of access does this key provide?

Accepted Answer

It allows unauthenticated invocation of the specific Azure Function endpoint associated with that key.. A leaked function key allows any external actor to invoke the specific Azure Function endpoint associated with that key, potentially triggering unauthorized backend logic or data access.

Answer

It allows the attacker to decrypt all Azure Key Vault secrets in the tenant.

Answer

It provides direct SSH root access to the underlying Azure App Service worker nodes.

Answer

It grants full Owner-level administrative access to the entire Azure subscription.

Question 3

A penetration tester is evaluating a Kubernetes environment and discovers that the Kubernetes dashboard is deployed with cluster-admin privileges and is exposed to the internet via a NodePort service without authentication. How can this be exploited?

Accepted Answer

An external attacker can access the dashboard web interface without credentials and deploy malicious pods with host-level access, resulting in complete cluster compromise.. An unauthenticated Kubernetes dashboard exposed via NodePort allows an attacker to execute arbitrary commands, deploy malicious pods, and take over the entire cluster.

Answer

The dashboard exposes the cloud provider root account password in plain text logs.

Answer

The attacker can harvest Kerberos ticket-granting tickets from the dashboard cache.

Answer

The attacker can perform a buffer overflow against the etcd TLS listener via the dashboard port.

Question 4

An AWS penetration tester discovers that an Amazon DynamoDB table contains sensitive PII stored in plaintext, and the table is encrypted using the default AWS owned key rather than a customer managed KMS key. What is the security recommendation?

Accepted Answer

Migrate the table encryption to use AWS Customer Managed Keys (CMKs) in AWS KMS to gain granular auditing, rotation, and access control.. While AWS owned keys provide encryption at rest, migrating to customer-managed KMS keys provides finer access control, auditing, and key rotation capabilities.

Answer

Disable TLS for all connections to the DynamoDB table.

Answer

Convert the DynamoDB table into an unencrypted Amazon S3 bucket.

Answer

Enable AWS WAF web ACLs directly on the DynamoDB table endpoint.

Question 5

An auditor is reviewing an AWS cloud environment and identifies several common misconfigurations related to identity and access management. Which TWO of the following practices represent significant security risks? (Choose TWO)

Accepted Answer

Using the AWS account root user credentials for day-to-day operational tasks.. Using root credentials for daily tasks and creating active access keys for root users violate foundational AWS security best practices.

Answer

Enabling multi-factor authentication (MFA) on all IAM users with console access.

Answer

Enabling AWS CloudTrail logging across all regions in the account.

Answer

Attaching AWS managed policies for read-only access to auditing roles.

Question 6

During a penetration test of an Azure Active Directory tenant, an attacker identifies multiple security misconfigurations. Which TWO of the following techniques represent common Azure AD attack vectors or misconfigurations? (Choose TWO)

Accepted Answer

Exploiting user consent settings that allow any user to grant application permissions to third-party multi-tenant apps.. Unrestricted user consent settings allowing apps to access tenant data and legacy authentication protocols lacking MFA enforcement are major Azure AD security risks.

Answer

Configuring Azure AD Connect with Password Hash Sync disabled for cloud-only users.

Answer

Implementing Azure Key Vault access policies with strict RBAC permissions.

Answer

Enforcing Azure Multi-Factor Authentication for all administrative and privileged roles.

Question 7

A penetration tester is assessing a Kubernetes cluster deployment. Which THREE of the following container or cluster configurations represent severe container escape or privilege escalation risks? (Choose THREE)

Accepted Answer

Mounting the host filesystem root directory via a hostPath volume (hostPath: path: /).. Running containers as root, mounting the Docker socket, and mounting sensitive host paths like / or /etc allow direct host compromise.

Answer

Using NetworkPolicies to restrict ingress and egress traffic between namespaces.

Answer

Enabling automountServiceAccountToken: false on non-privileged application pods.

Question 8

During a hybrid cloud assessment, a penetration tester examines the connection between an on-premises Active Directory and Azure AD. Which THREE of the following mechanisms or misconfigurations could lead to credential exposure or privilege escalation in the hybrid environment? (Choose THREE)

Accepted Answer

Storing application secrets and database connection strings in plaintext within Azure App Service configuration settings.. Over-privileged sync accounts, storing secrets in plaintext, and unmitigated PHS/PTA risks are major hybrid threats.

Answer

Enforcing Azure AD Conditional Access policies requiring compliant devices for access.

Answer

Using Azure Key Vault with managed hardware security modules (HSMs) for cryptographic keys.

Answer

Configuring Azure Bastion for secure administrative RDP and SSH connectivity.

Question 9

An auditor is evaluating cloud storage security across multiple cloud providers. Which TWO of the following settings indicate improper security configurations for cloud storage buckets? (Choose TWO)

Accepted Answer

An Amazon S3 bucket configured with ACLs allowing public read and write access.. Public read permissions and disabled encryption at rest are critical storage security findings.

Answer

An Azure Storage Account with 'Secure transfer required' set to Enabled.

Answer

Enabling versioning and object lock on financial data storage buckets.

Answer

Enabling AWS S3 Block Public Access at the account level.

Question 10

A penetration tester is evaluating AWS IAM policies for privilege escalation paths. Which THREE of the following IAM action combinations enable direct or indirect privilege escalation in an AWS environment? (Choose THREE)

Accepted Answer

ec2:RunInstances combined with iam:PassRole allowing assignment of high-privilege IAM roles to newly launched instances.. iam:CreateAccessKey, iam:PutUserPolicy, and iam:PassRole combined with compute actions allow privilege escalation.

Answer

cloudwatch:PutMetricData combined with logs:CreateLogGroup.

Answer

s3:GetObject combined with s3:PutObject on non-sensitive S3 buckets.

Answer

rds:DescribeDBInstances combined with ec2:DescribeSecurityGroups.

Question 11

During an Azure subscription review, a security assessor checks for role-based access control and resource configuration best practices. Which TWO of the following findings represent high-severity security risks? (Choose TWO)

Accepted Answer

Assigning the Owner role to external guest users at the root management group level without justification.. Assigning Owner/Contributor at the subscription root and leaving storage account access keys unrotated are major risks.

Answer

Enabling Azure Defender for SQL on all Azure SQL databases.

Answer

Configuring Azure Monitor alerts for failed sign-in attempts.

Answer

Enabling soft-delete and purge protection on Azure Key Vaults.

Question 12

An auditor reviews network security configurations in an AWS VPC. Which TWO of the following network configurations represent potential security risks? (Choose TWO)

Accepted Answer

A security group allowing inbound TCP port 3389 (RDP) from 0.0.0.0/0.. Exposing management ports like SSH (22) and RDP (3389) to 0.0.0.0/0 is a critical security risk.

Answer

Enabling AWS Shield Advanced for DDoS protection on Application Load Balancers.

Answer

Using AWS PrivateLink to connect securely to VPC endpoint services.

Answer

A VPC Flow Log enabled and streaming traffic data to an encrypted S3 bucket.

Question 13

A penetration tester is analyzing an enterprise cloud infrastructure utilizing both AWS and Azure. Which THREE of the following attack vectors or misconfigurations are relevant to hybrid and cloud security assessments? (Choose THREE)

Accepted Answer

Abusing misconfigured OpenID Connect (OIDC) federation trust settings between GitHub Actions and AWS IAM roles to assume roles without proper repository conditions.. SSRF targeting IMDS, unauthenticated API gateway endpoints, and misconfigured OIDC/service principal trust paths are core hybrid/cloud attack vectors.

Answer

Enabling AWS CloudTrail and guarding log files with immutable S3 Object Lock policies.

Answer

Configuring VPC peering with bi-directional network ACL restrictions.

Answer

Enforcing strict Azure AD Conditional Access policies based on device compliance and location.

Question 14

An auditor reviews cloud logging and monitoring configurations across an enterprise multi-cloud environment. Which TWO of the following practices represent critical security deficiencies? (Choose TWO)

Accepted Answer

Hardcoding cloud provider API access keys directly into public application source code repositories.. Disabling audit logging and storing static administrative keys in code repositories are critical security deficiencies.

Answer

Configuring automated alerts for unusual spikes in cloud resource creation.

Answer

Using cloud-native Key Management Services with automatic key rotation enabled.

Answer

Enforcing least-privilege access principles across all IAM service accounts.

Question 15

During a Kubernetes cluster security assessment, a penetration tester identifies multiple misconfigurations. Which TWO of the following findings represent high-risk security flaws in Kubernetes RBAC and cluster setup? (Choose TWO)

Accepted Answer

Exposing the Kubernetes API server endpoint directly to the public internet (0.0.0.0/0) without IP whitelisting or robust authentication.. Granting cluster-admin via ClusterRoleBinding to default service accounts and exposing the API server publicly without auth are severe risks.

Answer

Enabling Pod Security Standards (e.g., Restricted profile) across all namespaces.

Answer

Using network policies to isolate sensitive database pods from frontend web pods.

Answer

Enabling Kubernetes Role-Based Access Control (RBAC) across all API groups.