CPENT Cloud And Hybrid Infrastructure Security Practice Test 5 — 15 Questions

Question 1

During a penetration test of an Azure Active Directory tenant, an attacker identifies multiple security misconfigurations. Which TWO of the following techniques represent common Azure AD attack vectors or misconfigurations? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Exploiting user consent settings that allow any user to grant application permissions to third-party multi-tenant apps.. Option A is correct because when Microsoft Entra ID user consent settings permit all users to consent to third-party multi-tenant applications, attackers can register a malicious multi-tenant app and trick users into granting OAuth permissions (e.g., Mail.Read, offline_access), enabling persistent access and data exfiltration without stealing credentials. Option D is correct because legacy authentication protocols such as POP3, IMAP, and SMTP AUTH do not support modern authentication and therefore bypass Conditional Access policies and MFA, making them a prime vector for password-spray and credential-stuffing attacks. Option B is not a misconfiguration attack vector: disabling Password Hash Sync for cloud-only users is irrelevant since cloud-only accounts have no on-premises password to synchronize, and PHS is a defensive feature rather than an exposure. Option C is not an attack vector because strict RBAC access policies on Key Vault are a security best practice that reduces, not expands, the attack surface. Option E is not a misconfiguration because enforcing MFA for all administrative and privileged roles is a recommended hardening control that mitigates credential-based attacks.

Answer

Configuring Azure AD Connect with Password Hash Sync disabled for cloud-only users.

Answer

Implementing Azure Key Vault access policies with strict RBAC permissions.

Answer

Enforcing Azure Multi-Factor Authentication for all administrative and privileged roles.

Question 2

An auditor is evaluating cloud storage security across multiple cloud providers. Which TWO of the following settings indicate improper security configurations for cloud storage buckets? (Choose TWO)

Accepted Answer

An Amazon S3 bucket configured with ACLs allowing public read and write access.. Option A is correct because an S3 bucket ACL granting public read and write access (e.g., AllUsers with WRITE or WRITE_ACP permissions) allows anyone on the internet to upload, overwrite, or delete objects, which is a serious misconfiguration and a common cause of data breaches. Option C is correct because binding storage.objectViewer to allUsers in Google Cloud Storage makes every object in the bucket readable by anyone on the internet, exposing data without authentication. Option B is not improper: setting 'Secure transfer required' to Enabled on an Azure Storage Account enforces HTTPS/TLS for all requests, which is a security best practice. Option D is not improper: versioning plus object lock (e.g., S3 Object Lock in compliance mode) protects financial data against deletion or tampering and supports retention requirements. Option E is not improper: enabling S3 Block Public Access at the account level is a recommended guardrail that overrides bucket policies and ACLs to prevent public exposure.

Answer

An Azure Storage Account with 'Secure transfer required' set to Enabled.

Answer

Enabling versioning and object lock on financial data storage buckets.

Answer

Enabling AWS S3 Block Public Access at the account level.

Question 3

During an Azure subscription review, a security assessor checks for role-based access control and resource configuration best practices. Which TWO of the following findings represent high-severity security risks? (Choose TWO)

Accepted Answer

Assigning the Owner role to external guest users at the root management group level without justification.. Option B is correct because assigning the Owner role to external guest users at the root management group level grants them full control over every subscription and resource in the tenant, violating least-privilege and creating a severe privilege-escalation and data-exfiltration risk. Option E is correct because long-lived, unchanged storage account access keys with broad data access effectively act as permanent shared secrets; if leaked, they allow full access to the storage account's data, and key rotation is a core configuration best practice. Option A is not a risk but a recommended defense, since Azure Defender for SQL provides threat detection and vulnerability assessment for Azure SQL databases. Option C is not a risk because Azure Monitor alerts on failed sign-in attempts improve detection of brute-force or credential-stuffing activity. Option D is not a risk because soft-delete and purge protection on Azure Key Vaults are recommended safeguards that prevent accidental or malicious permanent deletion of secrets, keys, and certificates.

Answer

Enabling Azure Defender for SQL on all Azure SQL databases.

Answer

Configuring Azure Monitor alerts for failed sign-in attempts.

Answer

Enabling soft-delete and purge protection on Azure Key Vaults.

Question 4

An auditor reviews network security configurations in an AWS VPC. Which TWO of the following network configurations represent potential security risks? (Choose TWO)

Accepted Answer

A security group allowing inbound TCP port 3389 (RDP) from 0.0.0.0/0.. Option A is correct because a security group permitting inbound TCP 3389 (RDP) from 0.0.0.0/0 exposes Windows Remote Desktop to the entire internet, inviting brute-force and ransomware attacks. Option D is correct because allowing inbound TCP 22 (SSH) from 0.0.0.0/0 exposes Linux/Unix remote shell access to all source IPs, enabling credential brute-forcing and exploitation of SSH vulnerabilities. Option B is not a risk but a mitigation, since AWS Shield Advanced provides enhanced DDoS protection for Application Load Balancers. Option C is not a risk because AWS PrivateLink privately connects VPCs to endpoint services without exposing traffic to the public internet. Option E is not a risk because VPC Flow Logs to an encrypted S3 bucket is a secure, recommended monitoring practice.

Answer

Enabling AWS Shield Advanced for DDoS protection on Application Load Balancers.

Answer

Using AWS PrivateLink to connect securely to VPC endpoint services.

Answer

A VPC Flow Log enabled and streaming traffic data to an encrypted S3 bucket.

Question 5

An auditor reviews cloud logging and monitoring configurations across an enterprise multi-cloud environment. Which TWO of the following practices represent critical security deficiencies? (Choose TWO)

Accepted Answer

Hardcoding cloud provider API access keys directly into public application source code repositories.. Option B is correct because hardcoding cloud provider API access keys into public source code repositories exposes long-lived credentials to anyone who can view the repo, enabling unauthorized API calls, resource creation, and data exfiltration; secrets should instead be stored in a secrets manager or KMS-backed vault and injected at runtime. Option D is correct because disabling centralized audit logging such as AWS CloudTrail or Azure Activity Logs destroys the tamper-evident record of control-plane and data-plane activity, eliminating detection, forensic investigation, and compliance evidence, which is a critical monitoring deficiency regardless of storage cost savings. The unmarked options do not belong: A is a sound detection practice that surfaces anomalous resource creation, C is a recommended key-management practice using cloud-native KMS with automatic rotation, and E is a foundational IAM control that reduces blast radius by enforcing least privilege.

Answer

Configuring automated alerts for unusual spikes in cloud resource creation.

Answer

Using cloud-native Key Management Services with automatic key rotation enabled.

Answer

Enforcing least-privilege access principles across all IAM service accounts.

Question 6

During a Kubernetes cluster security assessment, a penetration tester identifies multiple misconfigurations. Which TWO of the following findings represent high-risk security flaws in Kubernetes RBAC and cluster setup? (Choose TWO)

Accepted Answer

Exposing the Kubernetes API server endpoint directly to the public internet (0.0.0.0/0) without IP whitelisting or robust authentication.. Option A is correct because exposing the Kubernetes API server to 0.0.0.0/0 removes network-level protection, allowing unauthenticated or brute-forced access to the control plane; the API server is the cluster's most sensitive endpoint, so public exposure without IP whitelisting or strong authentication is a high-risk misconfiguration. Option D is correct because binding the cluster-admin ClusterRole to the default service account in the default namespace grants every pod running under that service account full cluster-wide administrative privileges, enabling trivial privilege escalation and lateral movement if any such pod is compromised. Option B is not a flaw — enabling the Restricted Pod Security Standard hardens workloads by enforcing least-privilege pod settings. Option C is not a flaw — network policies that isolate database pods from frontend pods implement proper microsegmentation. Option E is not a flaw — enabling RBAC across all API groups is the recommended secure default, not a misconfiguration.

Answer

Enabling Pod Security Standards (e.g., Restricted profile) across all namespaces.

Answer

Using network policies to isolate sensitive database pods from frontend web pods.

Answer

Enabling Kubernetes Role-Based Access Control (RBAC) across all API groups.

Question 7

An auditor reviews an enterprise's hybrid cloud identity architecture. Which TWO of the following configurations represent insecure identity practices? (Choose TWO)

Accepted Answer

Disabling multi-factor authentication requirements for global administrator accounts during emergency maintenance windows.. Option A is correct because disabling multi-factor authentication for global administrator accounts—even temporarily during emergency maintenance—removes the strongest protection on the most privileged identities, exposing the tenant to credential-stuffing, phishing, and token-replay attacks that MFA would otherwise block. Option D is correct because non-expiring service account passwords combined with interactive logon rights create long-lived, human-usable credentials that violate least privilege and the separation of service and interactive accounts, making lateral movement and credential theft far easier. Option B is not an insecure practice: strong password complexity and expiration policies are standard hardening controls for cloud user accounts. Option C is not insecure: Microsoft Entra ID Protection is a defensive tool that detects compromised credentials and risky sign-ins. Option E is not insecure: Azure managed identities eliminate hardcoded credentials by issuing tokens through the platform, which is a recommended secure practice.

Answer

Enforcing strong password complexity and expiration policies for all cloud user accounts.

Answer

Implementing Microsoft Entra ID Protection to detect compromised credentials and risky sign-ins.

Answer

Utilizing Azure AD managed identities for Azure resources instead of hardcoded credentials.

Question 8

During an AWS security review, a penetration tester identifies several identity and storage policies. Which TWO of the following configurations are considered insecure? (Choose TWO)

Accepted Answer

An IAM role trust policy that permits assumption by any AWS account across the entire AWS partition without external ID checks.. Option A is insecure because an IAM role trust policy whose Principal allows any AWS account in the partition (for example, "AWS": "arn:aws:iam::*:root" or a wildcard account) lets arbitrary external accounts assume the role; without a sts:ExternalId condition, this enables the confused deputy problem and unauthorized cross-account access. Option E is insecure because an S3 bucket policy with "Principal": "*" and an Allow effect lacking restrictive conditions (such as aws:SourceArn, aws:SourceAccount, or aws:PrincipalOrgID) exposes the bucket to anonymous or unintended public access. Option B is not insecure: enabling S3 Object Versioning protects against overwrites and deletions and aids recovery, so it is a security best practice. Option C is not insecure: annual AWS KMS key rotation for customer-managed keys is a recommended practice that limits the blast radius of key compromise. Option D is not insecure: granting kms:* to the account root and trusted admin roles is the standard KMS key policy pattern, since the root principal is constrained by IAM policies and does not by itself grant broad access.

Answer

Enabling Amazon S3 Object Versioning on critical document storage buckets.

Answer

Enabling AWS KMS key rotation for all customer-managed cryptographic keys annually.

Answer

An AWS KMS key policy granting kms:* permissions to the root user and trusted admin roles only.

Question 9

A penetration tester is auditing an AWS environment and discovers that an IAM role used by an EC2 instance has an overly permissive trust policy allowing any principal in an external AWS account to assume it without specifying an ExternalId. What is the standard security term and remediation for this vulnerability?

Accepted Answer

Cross-account confused deputy vulnerability; remediate by adding a Condition block requiring an 'sts:ExternalId'.. Allowing external accounts to assume a role without an ExternalId leaves the configuration vulnerable to the 'Confused Deputy' problem. Remediation involves adding a condition using 'sts:ExternalId' to the trust policy.

Answer

Access Key exposure; remediate by rotating the static credentials associated with the IAM role.

Answer

Resource-based policy escalation; remediate by disabling cross-account access entirely in AWS Organizations.

Answer

IAM privilege escalation via PassRole; remediate by removing iam:PassRole permissions from the instance profile.

Question 10

A penetration tester is analyzing an Azure environment and discovers that an Azure Function App has been configured with managed identity enabled and possesses 'Contributor' access to the subscription. The function code contains a Server-Side Request Forgery (SSRF) vulnerability. How can the tester exploit the Azure Instance Metadata Service (IMDS) via this SSRF to elevate privileges?

Accepted Answer

Query 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01' with the header 'Metadata: true' to obtain an Azure access token using the managed identity.. The Azure Instance Metadata Service (IMDS) is accessible at http://169.254.169.254 and can provide an OAuth2 token for the managed identity when the request includes the header 'Metadata: true'. By exploiting SSRF, the tester can make the Function App issue a request to this endpoint and retrieve the token, which can then be used to access Azure resources with the Contributor role. This is a classic SSRF-to-cloud-metadata attack.

Answer

Send a crafted SOAP request to the Azure Resource Manager endpoint to extract the storage account account key.

Answer

Extract the master deployment credentials from the Azure Web Job environment variables via port 443.

Answer

Exploit the Azure Function proxy configuration to read the /etc/passwd file from the underlying hypervisor.

Question 11

When reviewing container security and Kubernetes cluster configurations, which THREE practices or misconfigurations commonly lead to container escapes or host compromise? (Choose three)

Accepted Answer

Exposing sensitive host directories (such as '/' or '/proc') via 'hostPath' volumes.. Option B is correct because mounting sensitive host directories such as '/' or '/proc' through a hostPath volume gives the container direct read/write access to host files, kernel interfaces, and process information, which an attacker can abuse to modify host binaries, read secrets, or escape the container boundary. Option C is correct because setting privileged: true disables most container isolation, grants all Linux capabilities, and removes seccomp/AppArmor restrictions, effectively giving the container root-level control over the host devices and kernel. Option D is correct because mounting /var/run/docker.sock exposes the Docker daemon API to the container, allowing an attacker to create a new privileged container that mounts the host filesystem and thereby compromise the node. Option A is not a risk but a hardening practice, since running as a non-root UID (USER 1000) reduces the impact of a compromise. Option E is also a security best practice, as RBAC with least-privilege bindings limits what identities can do in the cluster rather than enabling escapes.

Answer

Using a non-root user directive (USER 1000) inside the Dockerfile.

Answer

Enabling Kubernetes Role-Based Access Control (RBAC) with least-privilege binding.

Question 12

A penetration tester is assessing a Microsoft 365 tenant and discovers that a global administrator account has no multi-factor authentication (MFA) enforcement. The tester wants to exploit this to gain persistent access to the tenant's email and files. Which Azure AD feature, if misconfigured, would allow the attacker to maintain access even after the initial password is changed?

Accepted Answer

Azure AD application with a client secret that has a long expiration. A global administrator can create or modify an Microsoft Entra ID application and add a client secret. This secret acts as a credential for the service principal and remains valid until it expires or is revoked, regardless of the user's password changes. Attackers often use this technique to maintain persistence in Microsoft 365 environments, as it allows continued access to mail, files, and other resources granted to the application.

Answer

Azure AD password protection with a custom banned password list

Answer

Azure AD Privileged Identity Management (PIM) with just-in-time access

Answer

Azure AD Conditional Access policy that blocks legacy authentication

Question 13

During a penetration test of a Microsoft Azure environment, a tester obtains a managed identity token for a virtual machine. The token has permissions to read secrets from an Azure Key Vault. Which technique can the tester use to escalate privileges by leveraging the Key Vault access?

Accepted Answer

Retrieve a secret from the Key Vault that contains credentials for a service principal with higher privileges, then authenticate as that service principal.. The managed identity can read secrets from Key Vault. Secrets often contain credentials for other identities. By retrieving a secret that holds higher-privileged credentials, the tester can authenticate as that identity and escalate privileges. This is a common lateral movement technique in Azure.

Answer

Modify the Key Vault's firewall rules to allow the tester's IP address, then access the Key Vault directly with the managed identity token.

Answer

Use the managed identity to add a new access policy to the Key Vault that grants the tester's own Azure AD user full permissions.

Answer

Use the managed identity to export the Key Vault's private keys and then forge a token for an Azure AD administrator.

Question 14

A penetration tester is evaluating a Google Cloud Platform (GCP) environment and discovers a service account key file stored in a public Cloud Storage bucket. The service account has the roles/editor role on the project. What is the most direct way for the tester to leverage this key to gain unauthorized access to the project's resources?

Accepted Answer

Use the key to authenticate with gcloud auth activate-service-account and then list and access resources.. A leaked service account key file allows an attacker to authenticate as that service account. Using gcloud auth activate-service-account with the key file grants the tester the service account's permissions, which include the editor role. This provides broad access to the project's resources, enabling the tester to list, read, and modify data, and potentially escalate further.

Answer

Use the key to sign a JWT and impersonate a user with higher privileges.

Answer

Use the key to decrypt data in Cloud Storage buckets encrypted with customer-managed encryption keys (CMEK).

Answer

Use the key to access the GCP metadata server and retrieve instance credentials.

Question 15

A penetration tester is assessing a Microsoft Azure environment and discovers that a virtual machine (VM) has a system-assigned managed identity enabled. The VM is running a web application that is vulnerable to server-side request forgery (SSRF). The tester wants to exploit the SSRF to gain access to Azure resources. Which TWO of the following actions can the tester perform to leverage the managed identity? (Choose two.)

Accepted Answer

Query the Azure Instance Metadata Service (IMDS) endpoint at http://169.254.169.254/metadata/identity/oauth2/token to obtain an access token for the managed identity.. The two correct actions are querying the IMDS endpoint to obtain an access token and using that token to call Azure Resource Manager if the managed identity has Reader permissions. These steps allow an attacker to leverage SSRF to steal the managed identity's token and then access Azure resources. The other options are incorrect because they assume capabilities that IMDS does not provide, such as retrieving certificates or modifying role assignments, or they require permissions not typically granted to managed identities.

Answer

Modify the managed identity's role assignments by sending a PATCH request to the IMDS endpoint to add the Contributor role.

Answer

Retrieve the managed identity's certificate from the IMDS endpoint and use it to authenticate as the managed identity to any Azure service.

Answer

Use the managed identity's credentials to authenticate to Azure Active Directory (Azure AD) and enumerate all users and groups in the tenant.