CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Delete the bucket to prevent further data exposure

  Why it's wrong here

  Deleting an S3 bucket is a highly destructive action that falls outside the scope of a standard penetration test. Such an action would disrupt legitimate business operations, potentially cause irreversible data loss for the client, and violate the agreed-upon rules of engagement. Penetration testers are authorized to identify and report vulnerabilities, not to perform remediation actions that could impact system availability or data integrity.

• ✓

  Use the keys to call sts:GetCallerIdentity and then enumerate permissions via IAM

  Why this is correct

  After discovering AWS access keys, the immediate and most prudent step is to validate their authenticity and determine the associated identity using sts:GetCallerIdentity. This API call confirms the keys are active and reveals the IAM user or role they belong to. Following this, enumerating the permissions attached to that identity via IAM policies is critical to understand the full scope of access, identify potential escalation paths, and discover other high-value targets within the AWS environment.

• ✗

  Download all objects from the bucket and exfiltrate them

  Why it's wrong here

  Downloading all objects from the bucket is premature because the discovered IAM credentials in `config.json` likely grant broader access than the bucket’s public listing permission; the correct next step is to first test those credentials against the cloud provider’s API to enumerate privileges and identify high-value targets. This action is tempting because exfiltration is the ultimate goal of a data breach, and in a scenario where the bucket already contains sensitive data and no credentials are present, bulk download would be the correct choice.

• ✗

  Immediately rotate the keys in the AWS console

  Why it's wrong here

  Immediately rotating the discovered AWS access keys in the console is an inappropriate action during a penetration test. Such an action would prematurely alert the client to the compromise, potentially triggering incident response procedures before the full extent of the vulnerability can be assessed. Furthermore, rotating the keys would revoke the tester's access, preventing further enumeration, privilege escalation attempts, or discovery of additional sensitive assets, thereby hindering the test's objectives.

Go deeper

Related to this question