CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Denial of service by deleting objects

  Why it's wrong here

  Public read access to an S3 bucket specifically grants the s3:GetObject permission, allowing users to retrieve objects. It does not, however, confer permissions like s3:DeleteObject or s3:PutObject which are required to modify or remove existing data. Therefore, an attacker with only public read access cannot perform a denial-of-service attack by deleting objects, as they lack the necessary write or delete privileges.

• ✗

  SSRF attack to internal metadata

  Why it's wrong here

  Server-Side Request Forgery (SSRF) attacks typically exploit a vulnerable server-side application that can be tricked into making requests to internal network resources. While S3 buckets can host static content, public read access to the S3 service itself does not provide a mechanism to force the underlying AWS infrastructure or any associated compute instances to initiate arbitrary internal requests to metadata endpoints. S3 is a storage service, not a compute environment susceptible to direct SSRF exploitation via its public access policy.

• ✗

  Privilege escalation via IAM role

  Why it's wrong here

  Public read access to an S3 bucket is a granular permission granted via a bucket policy, allowing anonymous users to perform s3:GetObject actions. This access is strictly limited to reading data within that specific bucket and does not extend to or grant any AWS Identity and Access Management (IAM) role permissions. Consequently, an attacker cannot leverage public S3 read access to assume an IAM role or escalate privileges within the AWS account, as these actions require explicit IAM permissions distinct from S3 object access.

• ✓

  Unauthorized data access and exfiltration

  Why this is correct

  When an S3 bucket is configured for public read access, it means that the bucket policy explicitly permits the s3:GetObject action for the * principal (anonymous users). This configuration allows anyone on the internet to enumerate and download all objects stored within that bucket without requiring any authentication. This direct and unrestricted access inevitably leads to unauthorized data access and subsequent exfiltration, constituting a severe data breach where sensitive information can be freely downloaded.

Go deeper

Related to this question