CPENT Cloud And Hybrid Infrastructure Security — Timed 25 Questions

Question 1

A penetration tester is analyzing a Kubernetes cluster deployed on AWS (EKS) where a compromised pod is running with a service account that has access to the AWS IAM OIDC provider endpoint. The pod's container is running as root and has the host network namespace enabled. Which technique allows the tester to pivot from the container to the underlying cloud infrastructure?

25 minute time limit — choose an answer to begin.

Accepted Answer

Query the local Kubernetes API server using the projected service account token mounted in the pod to extract AWS STS credentials if an IAM role is annotated.. Accessing the container metadata or using the token exchange via the IAM OIDC provider allows the tester to obtain cloud credentials.

Answer

Execute the docker-runc exploit directly against the Docker daemon socket mounted inside the container.

Answer

Modify the kube-dns deployment manifest to redirect cloud control plane traffic to a local proxy.

Answer

Leverage the Azure Instance Metadata Service endpoint to retrieve subscription-level access tokens.

Question 2

While reviewing a hybrid identity deployment utilizing Azure AD Connect, a penetration tester observes that Password Hash Sync (PHS) is enabled alongside Pass-Through Authentication (PTA). What security implication does this configuration present during an on-premises domain compromise?

Accepted Answer

Password hashes for all synchronized accounts are stored in Azure AD, meaning compromise of the cloud tenant could expose on-premises credentials.. When PHS is enabled, synchronized password hashes reside in Azure AD, meaning a complete on-premises compromise exposes the hashes of all synced accounts to cloud credential dumping if Azure AD is later targeted.

Answer

Pass-through authentication agents become vulnerable to remote code execution via the Azure service bus.

Answer

Azure AD Connect agents will automatically downgrade encryption standards for domain controller communications.

Answer

Kerberos ticket granting service requests are bypassed entirely for hybrid users.

Question 3

An auditor finds an Amazon S3 bucket configured with public read access enabled via an Access Control List (ACL), but the bucket policy explicitly denies public read access. How does AWS evaluate these conflicting permissions?

Accepted Answer

The explicit Deny in the bucket policy takes precedence, resulting in access being denied.. AWS evaluation logic states that an explicit Deny anywhere in the policy evaluation overrides all allows.

Answer

AWS generates a configuration error and blocks all traffic until the conflict is resolved manually.

Answer

Access is granted because any Allow permission supersedes bucket restrictions.

Answer

The public ACL takes precedence because ACLs are evaluated before bucket policies.

Question 4

A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?

Accepted Answer

Leveraging the cgroups release_agent notification mechanism to execute arbitrary commands on the host operating system.. Writing a malicious payload to the release_agent file in cgroups combined with triggering a notification via the notify_on_release mechanism allows executing commands on the host as root.

Answer

Writing directly to the host's /etc/passwd file via a shared memory segment mounted at /dev/shm.

Answer

Using the ptrace system call to inject code into the host's systemd daemon process.

Answer

Issuing a mount command to repartition the host's primary storage block device.

Question 5

During an Azure assessment, an auditor finds that a Logic App has an HTTP trigger with no authentication mechanism configured (Anonymous access). The Logic App has permissions to read sensitive Azure Blob Storage containers. What type of vulnerability does this represent?

Accepted Answer

Insecure Direct Object Reference and unauthenticated workflow execution leading to data exfiltration.. Unauthenticated HTTP triggers in Azure Logic Apps allow external unauthenticated actors to invoke workflows, leading to unauthorized data access.

Answer

An OAuth token replay attack against the Azure Resource Manager control plane.

Answer

A Server-Side Request Forgery vulnerability within the Azure App Service sandbox.

Answer

A privilege escalation path from Contributor to Owner role.

Question 6

During an assessment of an Azure tenant, an attacker successfully exploits a user credential and enumerates enterprise applications. They identify a service principal with a high-privilege app role assignment (e.g., PrivilegedRoleAdministrator.ReadWrite.All). What is the primary attack path enabled by this misconfiguration?

Accepted Answer

The attacker can leverage the service principal credentials to assign high-privilege Azure AD roles to unauthorized user accounts.. A compromised service principal holding directory or role administration permissions can create new global administrators or modify role assignments.

Answer

The attacker can perform a Kerberoasting attack against the Azure Active Directory cloud database.

Answer

The attacker can extract the plaintext passwords of all cloud administrators from the Azure Key Vault logs.

Answer

The attacker can directly modify the underlying hypervisor configuration of Azure virtual machines.

Question 7

An AWS penetration tester identifies an EC2 instance configured with an IAM instance profile that grants broad s3:* permissions across all S3 buckets in the account. What AWS service feature should be recommended to restrict these permissions based on least privilege?

Accepted Answer

AWS IAM Access Analyzer and CloudTrail analysis to generate least-privilege IAM policies based on actual usage.. AWS IAM Access Analyzer helps identify unused permissions and allows policy generation based on actual access history.

Answer

AWS Shield Advanced to inspect and block unauthorized S3 API requests at the network layer.

Answer

AWS Trusted Advisor to enforce mandatory multi-factor authentication on all S3 API calls.

Answer

Amazon GuardDuty to automatically quarantine the EC2 instance upon detecting broad S3 access.

Question 8

A penetration tester is evaluating an AWS environment and discovers that an IAM role attached to an Amazon EC2 instance has an overly permissive trust policy allowing any user in the account to assume it via the sts:AssumeRole API without external conditions. Which specific remediation step should the cloud administrator apply to fix this risk?

Accepted Answer

Modify the IAM role trust policy to include a Condition block restricting the principal or requiring multi-factor authentication.. Restricting the trust policy with conditions such as aws:PrincipalTag or source ARN ensures only authorized entities can assume the role.

Answer

Rotate the AWS account root user access keys immediately.

Answer

Attach an explicit Deny policy to the EC2 instance metadata service version 2 configuration.

Answer

Disable the AWS Security Token Service endpoint globally across the AWS organization.

Question 9

An AWS administrator wants to prevent users from accidentally creating public Amazon S3 buckets across the entire AWS account. Which specific AWS feature should be enabled?

Accepted Answer

S3 Block Public Access at the AWS account level.. S3 Block Public Access at the account level blocks the creation of public buckets and modification of public policies organization-wide.

Answer

AWS Web Application Firewall rules attached to the S3 global endpoint.

Answer

AWS Organizations Service Control Policies blocking the s3:PutBucketAcl action.

Answer

Amazon Macie to automatically encrypt all public buckets.

Question 10

In a hybrid enterprise environment, an organization uses Azure AD Seamless Single Sign-On (Seamless SSO). During a penetration test, an attacker compromises a domain-joined workstation and attempts to abuse Seamless SSO. What is the mechanism by which Seamless SSO authenticates users, and what is a known security consideration?

Accepted Answer

It uses a computer account (AZUREADSSOACC$) in on-premises AD to generate Kerberos tickets for users authenticating to cloud services via browser redirection.. Seamless SSO uses a Kerberos computer account (AZUREADSSOACC$) registered in on-premises AD; if compromised or poorly managed, it can be targeted for Kerberoasting or ticket manipulation.

Answer

It requires all users to store their plaintext Active Directory passwords in Azure Key Vault.

Answer

It bypasses all Conditional Access policies for users connecting from corporate networks.

Answer

It forces the domain controllers to export NTLMv1 hashes to the Azure cloud directory.

Question 11

A penetration tester is analyzing a Kubernetes cluster deployed on AWS (EKS) where a compromised pod is running with a service account that has access to the AWS IAM OIDC provider endpoint. The pod's container is running as root and has the host network namespace enabled. Which technique allows the tester to pivot from the container to the underlying cloud infrastructure?

25 minute time limit — choose an answer to begin.

Accepted Answer

Use the Docker CLI or API via the mounted socket to spin up a new container with the host root filesystem mounted at /mnt, then chroot into /mnt.. Mounting the Docker socket inside a container allows the container to interact with the host Docker daemon, enabling the creation of new containers with arbitrary host paths mounted.

Answer

Execute a container breakout by exploiting CVE-2019-5736 against the containerd runtime socket.

Answer

Extract the kube-apiserver TLS private key from the Docker daemon cache.

Answer

Send crafted HTTP requests to the Kubernetes API server using the Docker socket as a proxy.

Question 12

An auditor reviews an Azure storage account and notes that 'Secure transfer required' is set to Disabled. What security risk does this misconfiguration introduce?

Accepted Answer

Data in transit between clients and the storage account can be intercepted over unencrypted HTTP connections.. Disabling secure transfer allows unencrypted HTTP connections to the storage account, enabling potential Man-in-the-Middle (MitM) attacks to intercept data in transit.

Answer

Storage account access keys are transmitted in plaintext during Azure Resource Manager API calls.

Answer

Shared Access Signatures (SAS) tokens expire immediately upon generation.

Answer

Blob storage data at rest is stored without AES-256 encryption.

Question 13

During an assessment of a Google Cloud Platform (GCP) environment, a penetration tester finds a Compute Engine instance with default service account credentials and scopes set to https://www.googleapis.com/auth/cloud-platform. What security implication does this broad scope present?

Accepted Answer

The service account possesses permissions across all GCP services unless explicitly restricted by IAM project-level bindings.. The default compute service account with full cloud-platform scope grants broad access to GCP APIs unless further restricted by IAM roles.

Answer

Google Cloud automatically rotates the service account private key every 60 seconds.

Answer

The instance is automatically accessible via SSH from any external IP address without firewall rules.

Answer

The instance metadata server disables access tokens to prevent Server-Side Request Forgery.

Question 14

A security engineer discovers that an AWS IAM user has an active access key and permissions to run ec2:RunInstances, iam:PassRole, and iam:CreateRole. What privilege escalation path does this permission combination represent?

Accepted Answer

The user can launch a new EC2 instance and attach a privileged IAM role via iam:PassRole, then access the instance to obtain temporary security credentials.. An attacker with iam:PassRole and ec2:RunInstances can spin up an EC2 instance passing an elevated IAM role, then log into the instance via SSH or session manager to extract the role's temporary credentials.

Answer

The user can modify the trust policy of the root user account using iam:CreateRole.

Answer

The user can inject malicious code into the AWS Nitro Enclave hypervisor layer.

Answer

The user can escalate privileges by updating their own MFA device via the EC2 metadata service.

Question 15

An AWS penetration tester discovers that an Amazon RDS database instance has the 'Publicly Accessible' flag set to true, and its security group allows inbound traffic from 0.0.0.0/0 on port 3306. What is the immediate risk, and what is the recommended control?

Accepted Answer

The database can be reached from the internet; the security group should be restricted to trusted CIDR blocks and public accessibility disabled.. The database is exposed to the public internet, requiring network ACLs, security group restriction, and disabling public accessibility.

Answer

S3 bucket policies will automatically override database access controls.

Answer

The database is vulnerable to container escape via Docker socket exposure.

Answer

IAM role trust policies are bypassed by external SQL injection attacks.

Question 16

A penetration tester is analyzing a Kubernetes cluster deployed on AWS (EKS) where a compromised pod is running with a service account that has access to the AWS IAM OIDC provider endpoint. The pod's container is running as root and has the host network namespace enabled. Which technique allows the tester to pivot from the container to the underlying cloud infrastructure?

25 minute time limit — choose an answer to begin.

Accepted Answer

By exploiting an application vulnerability to obtain the service account token, then querying the Kubernetes API to dump all cluster-wide secrets.. If the namespace is exposed or pods running the default service account are compromised via an RCE vulnerability, the attacker can harvest sensitive application secrets across the entire cluster.

Answer

By executing a kernel-level exploit against the etcd database directly from outside the cluster.

Answer

By generating a self-signed certificate authority to impersonate the kube-apiserver.

Answer

By performing a DNS poisoning attack against CoreDNS to redirect authentication tokens.

Question 17

During an Azure assessment, an attacker discovers that an App Service web application has Managed Identity enabled and the underlying application code is vulnerable to Server-Side Request Forgery (SSRF). How can the attacker chain these vulnerabilities?

Accepted Answer

By using the SSRF vulnerability to query the Azure Instance Metadata Service (IMDS) and retrieve access tokens for the Managed Identity.. An attacker exploiting SSRF can query the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254 to acquire OAuth access tokens for the managed identity.

Answer

By extracting the plaintext storage account keys from the kudu SCM debug console logs.

Answer

By forcing the App Service to downgrade its TLS version to SSLv3.

Answer

By injecting malicious PowerShell commands into the Azure Active Directory synchronization pipe.

Question 18

An administrator needs to secure communication between microservices running across different AWS Virtual Private Clouds (VPCs). Which native AWS networking feature provides private connectivity without exposing traffic to the public internet?

Accepted Answer

AWS VPC Endpoints powered by AWS PrivateLink.. AWS VPC Endpoints (powered by AWS PrivateLink) allow private connections between VPCs and AWS services or other VPCs without internet gateways.

Answer

Amazon CloudFront origin access control (OAC).

Answer

AWS Web Application Firewall (WAF) rule groups.

Answer

AWS Identity and Access Management resource-based policies.

Question 19

A penetration tester is evaluating a Kubernetes cluster utilizing Role-Based Access Control (RBAC) and notes that a custom role has the create verb on pods/exec resources. What security risk does this specific permission entail?

Accepted Answer

A user with this permission can execute arbitrary commands inside any running pod in the cluster, leading to potential node or cluster compromise.. The pods/exec permission allows a user to execute commands inside running pods, effectively granting arbitrary code execution in any pod where they can target execution.

Answer

The user can extract the master node's etcd database encryption keys.

Answer

The user can modify the cluster's underlying cloud provider IAM policies.

Answer

The user can bypass network policies by altering iptables rules on the host node.

Question 20

An attacker gains access to an Azure environment and enumerates App Service Configuration settings. They discover that connection strings and database passwords are stored in plaintext within the application settings rather than being referenced via Azure Key Vault references. What attack path does this enable?

Accepted Answer

Any user or service principal with read access to the App Service configuration can extract plaintext database credentials.. Storing secrets in plaintext in App Service configuration settings allows any user or service principal with Reader or Contributor access to the App Service to harvest sensitive credentials.

Answer

The attacker can perform a Golden Ticket attack against the Azure Active Directory Domain Services.

Answer

Azure Firewall automatically terminates the web application due to compliance violations.

Answer

The App Service hypervisor becomes vulnerable to guest-to-host breakout.