hardMultiple Choice
PT0-002 Practice Question: A penetration tester is evaluating a cloud…
A penetration tester is evaluating a cloud environment (AWS) and finds an S3 bucket with public write access. Which attack is most likely to succeed if the tester wants to plant malicious files that will be served to users?
⚠ Common exam trap
A common mix-up: candidates confuse 'public write access' with 'public read access' and assume the goal is to read data, or they may overthink the attack path and choose a privilege escalation option (D) instead of directly exploiting the write permission to plant malicious content.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Upload a malicious JavaScript file to the bucket
An S3 bucket with public write access allows anyone to upload objects without authentication. A penetration tester can upload a malicious JavaScript file (e.g., for cross-site scripting or drive-by download) that, when accessed by users via the bucket's public URL, executes in their browsers. This directly exploits the misconfiguration to serve malicious content to end users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Exhaust the bucket's storage quota
Why it's wrong here
Amazon S3 does not impose a fixed capacity quota that can be exhausted for a denial-of-service condition; storage is virtually unlimited and billed per GB. Even if the tester uploaded a massive number of objects, the effect would be financial cost to the account owner, not malware planting. The core objective of the attacker is to plant malicious content, which aligns with uploading files, not resource exhaustion.
- ✓
Upload a malicious JavaScript file to the bucket
Why this is correct
A bucket with public write (s3:PutObject for all principals) allows anyone to upload objects, including a crafted JavaScript file. If the bucket is used for static website hosting, an attacker can reference the uploaded .js file from a malicious page or inject it into a site that loads resources from that bucket, leading to XSS or malware distribution. This directly achieves the objective of planting malicious code in the cloud environment.
- ✗
Encrypt all objects in the bucket for ransom
Why it's wrong here
To encrypt existing objects for ransom, the attacker would need to list and read each object to re-upload it encrypted, but public write alone does not grant s3:ListBucket or s3:GetObject. Without knowledge of exact object keys, the attacker cannot target existing files; they could only upload new, separate objects that do not replace the originals. This approach is impractical and not a direct consequence of the write permission.
- ✗
Modify the bucket policy to grant further permissions
Why it's wrong here
Modifying a bucket policy requires the s3:PutBucketPolicy permission on the bucket, which is separate from object-level write permissions. The public write ACL grants s3:PutObject, not administrative control over the bucket's policy. An attacker with only object write access cannot escalate privileges by altering the policy, as that operation is governed by different IAM and bucket policy evaluation.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 777 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.