CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security analyst observes the following log entry on a web server: 'GET /?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1'. This request appears to originate from a compromised web application. Which cloud attack technique is being attempted?
⚠ Common exam trap
CEH often tests the confusion between SSRF and other injection attacks by presenting a URL that includes a parameter, leading candidates to mistakenly choose SQL Injection or XSS based on the presence of a query string.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-Side Request Forgery (SSRF)
The log shows a GET request with a 'url' parameter pointing to 'http://169.254.169.254/latest/meta-data/', which is the AWS Instance Metadata Service (IMDS) endpoint. An attacker is attempting to trick the server into making an HTTP request to this internal address on their behalf, a classic Server-Side Request Forgery (SSRF) attack. By accessing the metadata service, the attacker could retrieve sensitive information such as IAM credentials, instance identity documents, or user data. The presence of the 'url' parameter strongly indicates the application is designed to fetch remote resources, and the attacker is abusing that functionality to reach internal-only services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Server-Side Request Forgery (SSRF)
Why this is correct
Server-Side Request Forgery (SSRF) occurs when a web server is tricked into making requests to an arbitrary domain specified by an attacker. The log entry showing a request to `http://169.254.169.254/latest/meta-data/iam/security-credentials/` is a classic example targeting a cloud instance metadata service. This allows the attacker to obtain sensitive information, such as temporary IAM credentials, which can then be used to escalate privileges within the cloud environment.
- ✗
SQL Injection
Why it's wrong here
SQL Injection exploits vulnerabilities in an application's database queries, allowing attackers to inject malicious SQL code through user input. This attack primarily targets the database layer to retrieve, modify, or delete data, or even execute administrative commands. The observed log entry, however, describes an HTTP request to an internal IP address, not a manipulation of a database query.
- ✗
Container escape
Why it's wrong here
Container escape refers to a security vulnerability where an attacker breaks out of an isolated container environment to gain unauthorized access to the underlying host operating system. While a critical threat, the log entry indicates a network request originating *from* the server or container to an internal service. This action does not directly represent an attempt to compromise the host system itself, but rather leverages the container's network access.
- ✗
Cross-Site Scripting (XSS)
Why it's wrong here
Cross-Site Scripting (XSS) is a client-side code injection attack where malicious scripts are injected into legitimate websites and executed in the victim's web browser. This vulnerability typically aims to steal session cookies, deface web pages, or redirect users to malicious sites, impacting the end-user directly. The observed log entry, however, details a server-initiated request to an internal IP, which is a server-side action, not a client-side script execution.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A penetration tester is assessing the security of a cloud application and discovers that it is vulnerable to Server-Side Request Forgery (SSRF). Which TWO of the following are potential impacts of this vulnerability?
medium- A.Ability to perform a man-in-the-middle attack on the user's browser
- ✓ B.Access to cloud instance metadata (e.g., AWS IMDS)
- C.Direct modification of DNS records
- ✓ D.Remote code execution on internal servers
- E.Direct access to the database without authentication
Why B: Option B is correct because SSRF lets the attacker make the vulnerable server issue HTTP requests to the cloud metadata endpoint (e.g., http://169.254.169.254/latest/meta-data/ for AWS IMDS), potentially exposing IAM credentials, instance identity, and other sensitive data. Option D is correct because SSRF can be chained to reach internal-only services (such as Redis, Elasticsearch, or admin panels) that are not exposed externally, and those services may allow command execution or be exploited via deserialization/RCE vulnerabilities. Option A is not a direct SSRF impact because man-in-the-middle attacks on a user's browser require network interception or TLS compromise, not server-side request forgery. Option C is incorrect because modifying DNS records requires access to the DNS provider or zone management interface, which SSRF does not directly grant. Option E is incorrect because SSRF does not bypass database authentication; it only enables the server to make requests, and direct unauthenticated database access would require separate misconfiguration or credentials.
Variation 2. In a cloud environment, an attacker exploits a vulnerability in a web application to make the server send requests to internal metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/). This yields IAM temporary credentials. Which attack is this?
hard- ✓ A.Server-Side Request Forgery (SSRF) targeting cloud metadata
- B.XML External Entity (XXE) injection
- C.Insecure Direct Object Reference (IDOR) on metadata
- D.Cross-Site Request Forgery (CSRF) targeting cloud APIs
Why A: The attack described is Server-Side Request Forgery (SSRF) because the attacker manipulates the web application into making HTTP requests to an internal resource—specifically the cloud instance metadata service at 169.254.169.254. This allows the attacker to retrieve IAM temporary credentials that are normally only accessible from within the instance. The key is that the server itself is tricked into performing the request, bypassing network restrictions.
Variation 3. A penetration tester discovers that a cloud application is vulnerable to Server-Side Request Forgery (SSRF). Which of the following is a potential impact of this vulnerability?
hard- A.Cross-site scripting (XSS) in the browser
- B.Remote code execution via command injection
- ✓ C.Access to cloud instance metadata
- D.SQL injection in the database
Why C: SSRF allows the attacker to make requests from the server, potentially accessing internal services like metadata endpoints (e.g., http://169.254.169.254) that are not publicly accessible.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.