CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
In a cloud environment, an attacker exploits a vulnerability in a web application to make the server send requests to internal metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/). This yields IAM temporary credentials. Which attack is this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-Side Request Forgery (SSRF) targeting cloud metadata
SSRF occurs when an application fetches user-controlled URLs without proper validation. The attacker used it to access cloud metadata endpoints (like AWS IMDS) to retrieve temporary credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Server-Side Request Forgery (SSRF) targeting cloud metadata
Why this is correct
An SSRF vulnerability allows an attacker to manipulate a vulnerable server-side application into making arbitrary requests to internal network resources on behalf of the attacker. In cloud environments, this is critically dangerous as it can be leveraged to query the cloud provider's instance metadata service, typically found at a well-known, non-routable IP address like 169.254.169.254. Accessing this service often reveals temporary IAM credentials, instance profiles, and other sensitive configuration data, leading to privilege escalation or data exfiltration within the cloud infrastructure.
- ✗
XML External Entity (XXE) injection
Why it's wrong here
XXE injection exploits vulnerabilities in XML parsers that process external entities referenced within an XML document. While XXE can sometimes be a vector to achieve SSRF by defining an external entity that points to an internal resource, the question describes the direct exploitation of a vulnerability allowing the server to make internal requests. XXE is a specific input validation flaw in XML processing, whereas SSRF describes the broader class of vulnerability where the server is coerced into making requests to arbitrary internal or external destinations.
- ✗
Insecure Direct Object Reference (IDOR) on metadata
Why it's wrong here
IDOR vulnerabilities occur when an application exposes a direct reference to an internal implementation object, such as a file, database record, or directory, and fails to verify user authorization for accessing that object. Cloud metadata services, however, are accessed via fixed, well-known endpoints (e.g., 169.254.169.254/latest/meta-data/) rather than user-controlled, predictable object identifiers. Access to these metadata endpoints is typically restricted by network reachability from the instance itself, not by an IDOR-style authorization bypass.
- ✗
Cross-Site Request Forgery (CSRF) targeting cloud APIs
Why it's wrong here
CSRF is a client-side attack where an attacker tricks an authenticated user's browser into sending an unintended request to a vulnerable web application. This attack relies on the user's active session and browser cookies to execute actions on their behalf. In contrast, the scenario described involves a server-side vulnerability where the server itself is coerced into making internal requests, independent of any user's browser session or interaction. CSRF does not facilitate direct server-to-internal-resource communication.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.