CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security analyst observes the following log entry on a web server: 'GET /?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1'. This request appears to originate from a compromised web application. Which cloud attack technique is being attempted?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-Side Request Forgery (SSRF)
The IP address 169.254.169.254 is the AWS instance metadata service endpoint. An attacker using a Server-Side Request Forgery (SSRF) vulnerability can force the server to request this URL and retrieve sensitive instance metadata, such as IAM credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Server-Side Request Forgery (SSRF)
Why this is correct
Server-Side Request Forgery (SSRF) occurs when a web server is tricked into making requests to an arbitrary domain specified by an attacker. The log entry showing a request to `http://169.254.169.254/latest/meta-data/iam/security-credentials/` is a classic example targeting a cloud instance metadata service. This allows the attacker to obtain sensitive information, such as temporary IAM credentials, which can then be used to escalate privileges within the cloud environment.
- ✗
SQL Injection
Why it's wrong here
SQL Injection exploits vulnerabilities in an application's database queries, allowing attackers to inject malicious SQL code through user input. This attack primarily targets the database layer to retrieve, modify, or delete data, or even execute administrative commands. The observed log entry, however, describes an HTTP request to an internal IP address, not a manipulation of a database query.
- ✗
Container escape
Why it's wrong here
Container escape refers to a security vulnerability where an attacker breaks out of an isolated container environment to gain unauthorized access to the underlying host operating system. While a critical threat, the log entry indicates a network request originating *from* the server or container to an internal service. This action does not directly represent an attempt to compromise the host system itself, but rather leverages the container's network access.
- ✗
Cross-Site Scripting (XSS)
Why it's wrong here
Cross-Site Scripting (XSS) is a client-side code injection attack where malicious scripts are injected into legitimate websites and executed in the victim's web browser. This vulnerability typically aims to steal session cookies, deface web pages, or redirect users to malicious sites, impacting the end-user directly. The observed log entry, however, details a server-initiated request to an internal IP, which is a server-side action, not a client-side script execution.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A penetration tester is assessing the security of a cloud application and discovers that it is vulnerable to Server-Side Request Forgery (SSRF). Which TWO of the following are potential impacts of this vulnerability?
medium- A.Ability to perform a man-in-the-middle attack on the user's browser
- ✓ B.Access to cloud instance metadata (e.g., AWS IMDS)
- C.Direct modification of DNS records
- ✓ D.Remote code execution on internal servers
- E.Direct access to the database without authentication
Why B: SSRF can allow access to internal services (like metadata endpoints) and potentially lead to remote code execution if internal services are compromised.
Variation 2. In a cloud environment, an attacker exploits a vulnerability in a web application to make the server send requests to internal metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/). This yields IAM temporary credentials. Which attack is this?
hard- ✓ A.Server-Side Request Forgery (SSRF) targeting cloud metadata
- B.XML External Entity (XXE) injection
- C.Insecure Direct Object Reference (IDOR) on metadata
- D.Cross-Site Request Forgery (CSRF) targeting cloud APIs
Why A: SSRF occurs when an application fetches user-controlled URLs without proper validation. The attacker used it to access cloud metadata endpoints (like AWS IMDS) to retrieve temporary credentials.
Variation 3. A penetration tester discovers that a cloud application is vulnerable to Server-Side Request Forgery (SSRF). Which of the following is a potential impact of this vulnerability?
hard- A.Cross-site scripting (XSS) in the browser
- B.Remote code execution via command injection
- ✓ C.Access to cloud instance metadata
- D.SQL injection in the database
Why C: SSRF allows the attacker to make requests from the server, potentially accessing internal services like metadata endpoints (e.g., http://169.254.169.254) that are not publicly accessible.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.