CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  SSRF vulnerability in the cloud application

  Why it's wrong here

  A Server-Side Request Forgery (SSRF) vulnerability occurs when a web application is tricked into making requests to an unintended location, often internal network resources, on behalf of the attacker. The `wget http` command, however, is being executed directly by a security analyst from their client machine, indicating a direct external access attempt rather than leveraging a server-side vulnerability within a cloud application. This command does not demonstrate the server being coerced into making the request.

• ✗

  Container escape vulnerability

  Why it's wrong here

  A container escape vulnerability involves an attacker breaking out of an isolated containerized environment to gain unauthorized access to the underlying host operating system or other containers. The `wget http` command, in this context, is an external network request aimed at retrieving content from a specific URL, which is entirely unrelated to the internal security mechanisms or isolation failures associated with container escapes. It does not suggest any compromise of a container's boundaries.

• ✗

  Misconfigured IAM roles allowing privilege escalation

  Why it's wrong here

  Misconfigured IAM roles typically lead to privilege escalation by allowing an entity to assume a role with broader permissions than intended, granting access to internal AWS resources or actions. However, the `wget http` command directly targets an S3 bucket via its public URL, implying that the bucket itself is configured for public access. This action does not involve assuming or exploiting an IAM role for privilege escalation; it simply leverages existing public permissions without authentication.

• ✓

  Publicly accessible S3 bucket with list permissions enabled

  Why this is correct

  The `wget http` command is a standard utility for retrieving content from web servers, and when directed at an S3 bucket URL, it attempts to access the bucket without any AWS authentication. If this command successfully lists the bucket's contents, it unequivocally indicates that the Amazon S3 bucket has been misconfigured with a bucket policy or Access Control List (ACL) that grants public "s3:ListBucket" permissions to "AllUsers" or "Everyone," allowing unauthenticated enumeration of its objects.

Go deeper

Related to this question