CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A penetration tester uses the tool 'ScoutSuite' against an AWS target. Which of the following BEST describes the purpose of this tool?
⚠ Common exam trap
EC-Council often tests the distinction between auditing and exploitation, so the trap here is that candidates confuse 'auditing for misconfigurations' with 'exploiting vulnerabilities,' leading them to choose option C, even though ScoutSuite is purely a read-only assessment tool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Audit cloud infrastructure for misconfigurations and compliance
ScoutSuite is an open-source multi-cloud security auditing tool that assesses cloud environments (AWS, Azure, GCP) by scanning for misconfigurations and compliance violations. It does not perform exploitation or penetration testing; instead, it checks for issues like overly permissive security groups, unencrypted S3 buckets, or unused IAM roles, aligning with option D's description of auditing cloud infrastructure for misconfigurations and compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enumerate IAM users and roles for privilege escalation
Why it's wrong here
ScoutSuite's primary function is auditing cloud configurations, not actively identifying or exploiting privilege escalation paths within IAM. While it reports on IAM policies and their permissions, tools like Pacu are specifically designed for post-exploitation enumeration and exploitation of IAM misconfigurations to achieve privilege escalation by simulating attacks or identifying specific weak links. ScoutSuite provides the foundational configuration data that *could* be used for such an analysis, but it does not perform the escalation analysis or exploitation itself.
- ✗
Perform automated penetration testing of web applications
Why it's wrong here
ScoutSuite is purpose-built for cloud infrastructure security posture management, focusing on auditing configurations of services like S3, EC2, and IAM within major cloud providers. It does not interact with, analyze the code of, or assess the runtime behavior of web applications deployed *on* that infrastructure. Tools such as Burp Suite or OWASP ZAP are specifically designed for scanning web application vulnerabilities like SQL injection, XSS, and broken authentication, which is a distinct security domain.
- ✗
Exploit vulnerabilities in cloud services
Why it's wrong here
ScoutSuite operates as a passive auditing tool, generating a comprehensive report that details potential security misconfigurations and compliance deviations based on API calls to the cloud provider. It lacks any modules or functionalities designed to actively exploit identified vulnerabilities, such as executing commands on compromised instances, gaining unauthorized access to data, or leveraging misconfigurations for direct impact. Its role is strictly to *identify* and report issues, not to *act* upon them or perform offensive operations.
- ✓
Audit cloud infrastructure for misconfigurations and compliance
Why this is correct
ScoutSuite's core functionality involves programmatically fetching extensive configuration data from various cloud services, including AWS S3, EC2, IAM, and Security Groups, through API interactions. It then meticulously analyzes this collected data against a robust set of predefined security best practices and compliance benchmarks. This process culminates in a comprehensive, human-readable report highlighting critical misconfigurations such as publicly exposed storage buckets, overly permissive IAM policies, unencrypted resources, or unpatched instances, thereby providing a clear overview of the cloud environment's security posture.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.