CPENT Cloud And Hybrid Infrastructure Security Practice Test 4 — 15 Questions

Question 1

An administrator needs to secure communication between microservices running across different AWS Virtual Private Clouds (VPCs). Which native AWS networking feature provides private connectivity without exposing traffic to the public internet?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS VPC Endpoints powered by AWS PrivateLink.. AWS VPC Endpoints (powered by AWS PrivateLink) allow private connections between VPCs and AWS services or other VPCs without internet gateways.

Answer

Amazon CloudFront origin access control (OAC).

Answer

AWS Web Application Firewall (WAF) rule groups.

Answer

AWS Identity and Access Management resource-based policies.

Question 2

A penetration tester is evaluating a Kubernetes cluster utilizing Role-Based Access Control (RBAC) and notes that a custom role has the create verb on pods/exec resources. What security risk does this specific permission entail?

Accepted Answer

A user with this permission can execute arbitrary commands inside any running pod in the cluster, leading to potential node or cluster compromise.. The create verb on pods/exec in Kubernetes RBAC allows a user to invoke the exec subresource, which runs arbitrary commands inside a running container. This is effectively remote code execution within the pod's namespace, and if the pod has a mounted service account token or hostPath volume, the attacker can pivot to the node or cluster.

Answer

The user can extract the master node's etcd database encryption keys.

Answer

The user can modify the cluster's underlying cloud provider IAM policies.

Answer

The user can bypass network policies by altering iptables rules on the host node.

Question 3

An attacker gains access to an Azure environment and enumerates App Service Configuration settings. They discover that connection strings and database passwords are stored in plaintext within the application settings rather than being referenced via Azure Key Vault references. What attack path does this enable?

Accepted Answer

Any user or service principal with read access to the App Service configuration can extract plaintext database credentials.. Storing connection strings and passwords in plaintext within App Service configuration settings means that anyone with read access to the App Service's configuration can retrieve these secrets. This includes users or service principals with Reader role or higher on the App Service resource. The attack path is straightforward: extract credentials and use them to access backend databases or other services, potentially leading to data breach or further compromise.

Answer

The attacker can perform a Golden Ticket attack against the Azure Active Directory Domain Services.

Answer

Azure Firewall automatically terminates the web application due to compliance violations.

Answer

The App Service hypervisor becomes vulnerable to guest-to-host breakout.

Question 4

During an AWS penetration test, the tester finds an Amazon API Gateway REST API configured with an AWS_IAM authorizer, but one specific method is mistakenly set to 'Authorization: None' (Open API method). What security risk does this introduce?

Accepted Answer

Unauthenticated clients can invoke the specific API method directly, bypassing the intended AWS IAM signature authentication.. Setting a method's authorization type to 'None' (also called 'Open') on an API Gateway REST API removes the AWS_IAM SigV4 requirement for that specific method. Any unauthenticated client on the internet can then invoke that method's integration endpoint directly, bypassing the IAM-signed request flow the rest of the API enforces. This is a classic broken-access-control misconfiguration that exposes backend Lambda functions, DynamoDB operations, or internal services to anonymous abuse.

Answer

AWS WAF will automatically block all traffic to the API Gateway.

Answer

CloudFront distribution logs will fail to record incoming requests.

Answer

The API Gateway becomes vulnerable to SQL injection attacks against its internal DynamoDB storage.

Question 5

An auditor identifies that an organization's Azure storage account allows anonymous public read access to containers and blobs. What configuration change must be applied to remediate this finding?

Accepted Answer

Set the 'Allow Blob public access' property to Disabled on the storage account.. Disabling public blob access on the storage account blocks anonymous requests globally.

Answer

Rotate the primary storage account access key every 24 hours.

Answer

Enable Azure Defender for Storage and configure automatic threat remediation.

Answer

Apply an Azure Firewall rule blocking port 443 inbound to the storage account.

Question 6

A penetration tester is evaluating a hybrid Active Directory environment. They compromise an on-premises user account that has been synchronized to Azure AD. They discover that the on-premises account is a member of a high-privilege local group, but Azure AD Connect has filtered out this group synchronization. How can the tester leverage Azure AD Connect configuration weaknesses?

Accepted Answer

Examine Azure AD Connect synchronization rules and connector filters for misconfigurations or export rules that might inadvertently expose directory objects or allow rule manipulation.. Microsoft Entra Connect synchronization rules and connector filters determine which on-premises objects and attributes flow to Microsoft Entra ID. Misconfigurations — such as overly broad scoping filters, custom sync rules, or export rules — can inadvertently expose high-privilege objects or allow an attacker to manipulate rules to sync a privileged account into the cloud, enabling privilege escalation in Microsoft Entra ID.

Answer

Use the Azure AD Connect database password stored in the local SQL Express instance to perform a DCShadow attack.

Answer

Force Azure AD Connect to disable multi-factor authentication for all cloud administrators.

Answer

Inject a malicious DLL into the Azure AD Connect health agent service to execute arbitrary code on the Azure cloud domain controller.

Question 7

A penetration tester is assessing an AWS environment where an EC2 instance is associated with an IAM role that trusts an external third-party AWS account in its trust policy, but the external account ID was mistyped or left overly broad (e.g., condition missing external ID or using an insecure principal). What vulnerability does this introduce?

Accepted Answer

The trusted external account can assume the role, and without an ExternalID condition, it is vulnerable to cross-account confusion or unauthorized assumption.. When an IAM role trust policy allows an external AWS account to assume the role without an ExternalID condition, any principal in that account with sts:AssumeRole permissions can assume the role. If the external account ID is mistyped or overly broad, it could allow unintended accounts to assume the role, leading to unauthorized access. The ExternalID is a best practice to prevent the confused deputy problem, especially when third-party vendors are involved.

Answer

The EC2 instance is vulnerable to local root privilege escalation via kernel module injection.

Answer

AWS CloudTrail logs for the instance are permanently deleted.

Answer

The third-party account gains direct SSH access to the EC2 instance filesystem.

Question 8

An AWS penetration tester uncovers an IAM policy attached to a user that contains the action 'iam:PutUserPolicy' with a resource of '*'. What privilege escalation vector does this enable?

Accepted Answer

The user can attach an inline policy to their own IAM user granting full administrative access (AdministratorAccess).. The IAM action iam:PutUserPolicy allows a principal to create or replace an inline policy on any IAM user (when Resource is '*'). Because the policy can be attached to the attacker's own user, they can inject a policy granting themselves AdministratorAccess or any other privileged permissions, achieving full privilege escalation. This is a classic self-escalation path documented by Rhino Security Labs and others.

Answer

The user can modify the AWS billing dashboard and delete all EC2 instances.

Answer

The user can decrypt all KMS keys in the AWS region.

Answer

The user can delete the AWS account root user credentials.

Question 9

An auditor is reviewing an Azure Kubernetes Service (AKS) cluster and discovers that Role-Based Access Control (RBAC) was disabled during cluster creation, and Azure Active Directory integration is not enabled. What is the primary security consequence?

Accepted Answer

All API requests are treated with full administrative privileges, allowing any compromised pod or user to execute arbitrary cluster-level commands.. When RBAC and Microsoft Entra ID integration are disabled at AKS cluster creation, the cluster falls back to Kubernetes local accounts with certificate-based authentication, and any authenticated request effectively has full cluster-admin privileges. This means a compromised pod or user can execute arbitrary cluster-level commands, escalate privileges, and access secrets across namespaces.

Answer

Azure Security Center deletes the cluster automatically.

Answer

Pods are automatically restricted from communicating with external IP addresses.

Answer

The AKS cluster control plane is automatically exposed to the public internet on port 22.

Question 10

During an assessment of a Google Cloud Platform project, a penetration tester finds that a Cloud Storage bucket has the allUsers principal granted the Storage Object Viewer role. What security flaw does this represent, and how should it be fixed?

Accepted Answer

The bucket is public; the allUsers or allAuthenticatedUsers IAM binding must be removed to secure the data.. Granting allUsers IAM role bindings on a Cloud Storage bucket makes its objects publicly readable over the internet. Remediation requires removing the allUsers binding.

Answer

The bucket is vulnerable to GCP IAM privilege escalation via service account impersonation.

Answer

Google Cloud Armor automatically deletes the bucket objects.

Answer

Compute Engine instances can no longer mount the bucket as a persistent disk.

Question 11

An Azure penetration tester identifies a Virtual Machine with public IP access that has an incoming Network Security Group (NSG) rule allowing TCP port 3389 (RDP) from any source ('Any' or 'Internet'). What is the recommended remediation?

Accepted Answer

Restrict the NSG rule source IP to trusted administrative networks or implement Azure Bastion for secure management.. The NSG rule exposes RDP (TCP 3389) to the entire internet, which is the primary attack surface for brute-force, BlueKeep-style exploits, and ransomware initial access. The correct remediation is to narrow the source to trusted administrative IP ranges or, better, remove the public RDP exposure entirely and use Azure Bastion, which provides browser-based RDP/SSH over TLS through the Azure portal without a public IP on the VM. This directly addresses the misconfiguration while preserving administrative access.

Answer

Disable the Azure Key Vault service across the subscription.

Answer

Enable Azure Active Directory Pass-Through Authentication on the VM guest OS.

Answer

Attach an AWS IAM instance profile to the Azure Virtual Machine.

Question 12

A penetration tester is analyzing a Kubernetes cluster where pods utilize service accounts with automountServiceAccountToken set to true globally or on sensitive pods. The tester gains remote code execution inside a pod running with a high-privilege service account token. How can they use this token against the Kubernetes API?

Accepted Answer

Use the token in HTTP Authorization Bearer headers to query the Kubernetes API server and inspect or manipulate cluster resources based on the service account's RBAC privileges.. A Kubernetes service account token is a JWT that authenticates to the Kubernetes API server when presented as a Bearer token in the HTTP Authorization header. The API server validates the token's signature and expiry, then maps it to the service account's identity and enforces RBAC policies. With a high-privilege service account, the tester can list, create, or delete resources (e.g., secrets, pods) permitted by that account's RoleBindings or ClusterRoleBindings. This is the standard method for exploiting a compromised service account token in a cluster.

Answer

Convert the token into an Azure AD refresh token using Microsoft Graph API.

Answer

Submit the token to the AWS IAM STS assume-role API to gain root access to the underlying AWS cloud account.

Answer

Inject the token into the Linux kernel keyring to escalate the container to host root privileges.

Question 13

During an Azure penetration test, an attacker identifies an Azure Function with an HTTP trigger that uses function-level keys. However, the function key was leaked in a public GitHub repository. What level of access does this key provide?

Accepted Answer

It allows unauthenticated invocation of the specific Azure Function endpoint associated with that key.. Azure Function keys are per-function (or per-host) shared secrets used only to authorize HTTP invocations of that function's endpoint. A leaked function-level key lets an unauthenticated attacker call that specific function URL, but it does not grant Azure RBAC permissions, Key Vault access, or subscription-level control. The blast radius is limited to whatever the function itself does.

Answer

It allows the attacker to decrypt all Azure Key Vault secrets in the tenant.

Answer

It provides direct SSH root access to the underlying Azure App Service worker nodes.

Answer

It grants full Owner-level administrative access to the entire Azure subscription.

Question 14

A penetration tester is evaluating a Kubernetes environment and discovers that the Kubernetes dashboard is deployed with cluster-admin privileges and is exposed to the internet via a NodePort service without authentication. How can this be exploited?

Accepted Answer

An external attacker can access the dashboard web interface without credentials and deploy malicious pods with host-level access, resulting in complete cluster compromise.. An unauthenticated Kubernetes dashboard exposed via NodePort allows an attacker to execute arbitrary commands, deploy malicious pods, and take over the entire cluster.

Answer

The dashboard exposes the cloud provider root account password in plain text logs.

Answer

The attacker can harvest Kerberos ticket-granting tickets from the dashboard cache.

Answer

The attacker can perform a buffer overflow against the etcd TLS listener via the dashboard port.

Question 15

An auditor is reviewing an AWS cloud environment and identifies several common misconfigurations related to identity and access management. Which TWO of the following practices represent significant security risks? (Choose TWO)

Accepted Answer

Using the AWS account root user credentials for day-to-day operational tasks.. Using root credentials for daily tasks and creating active access keys for root users violate foundational AWS security best practices.

Answer

Enabling multi-factor authentication (MFA) on all IAM users with console access.

Answer

Enabling AWS CloudTrail logging across all regions in the account.

Answer

Attaching AWS managed policies for read-only access to auditing roles.