CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  An attacker exploits a web application to send HTTP requests from the server to an internal metadata endpoint

  Why this is correct

  This scenario perfectly illustrates Server-Side Request Forgery (SSRF). The attacker manipulates a vulnerable web application to force the server itself to initiate HTTP requests to an arbitrary internal or external destination. In a cloud environment, targeting the internal metadata service (e.g., http://169.254.169.254/latest/meta-data/) is a common and critical SSRF exploitation technique, allowing the retrieval of sensitive information like IAM role credentials. This effectively turns the compromised server into a proxy for internal network reconnaissance and privilege escalation.

• ✗

  An attacker intercepts traffic between a load balancer and backend servers

  Why it's wrong here

  Intercepting traffic between a load balancer and backend servers describes a classic Man-in-the-Middle (MITM) attack. In this scenario, the attacker positions themselves between two communicating parties, secretly relaying and potentially altering the communication without their knowledge. This differs fundamentally from SSRF, where the server itself is coerced into making outbound requests, rather than the attacker directly observing or modifying existing network traffic flows.

• ✗

  An attacker uses a SQL injection to extract database contents

  Why it's wrong here

  This describes a SQL Injection (SQLi) vulnerability, where an attacker injects malicious SQL code into input fields to manipulate database queries. The goal is typically to extract, modify, or delete data directly from the database by altering the application's intended database commands. While highly impactful, SQLi focuses on database interaction and data manipulation, which is distinct from SSRF's mechanism of forcing the server to make arbitrary network requests to other services or internal endpoints.

• ✗

  An attacker uploads a malicious file to an S3 bucket that executes code on the server

  Why it's wrong here

  Uploading a malicious file to an S3 bucket that subsequently executes code on a server typically points to a file upload vulnerability, potentially leading to Remote Code Execution (RCE). This attack relies on the server processing or executing the uploaded content without proper validation or sanitization, allowing the attacker's code to run. This is distinct from SSRF, which involves the server making outbound network requests to internal or external resources based on attacker-controlled input, rather than executing uploaded code.

Go deeper

Related to this question