CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
Which THREE of the following are valid methods for exploiting cloud misconfigurations? (Select 3)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using a container escape to access the host OS
S3 bucket public read access, overly permissive IAM roles, and container escape are all cloud misconfiguration exploitation vectors. SQL injection is a web app vulnerability, not cloud-specific. DDoS is an attack type, not a misconfiguration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Using a container escape to access the host OS
Why this is correct
Using a container escape to access the host OS is a critical cloud misconfiguration vulnerability. This occurs when a flaw in the container runtime, kernel, or container configuration allows an attacker to break out of the isolated container environment and gain unauthorized access to the underlying host operating system. Such an escape often leverages misconfigured capabilities, insecure mounts, or unpatched kernel vulnerabilities, directly exposing the host infrastructure to compromise.
- ✓
Exploiting an S3 bucket with public read access to download sensitive files
Why this is correct
Exploiting an S3 bucket with public read access to download sensitive files represents a common cloud misconfiguration. When an Amazon S3 bucket's access control policies are incorrectly configured to allow public read permissions, any internet user can access and download its contents without authentication. This oversight frequently leads to data breaches involving proprietary information, customer data, or internal credentials, making it a direct result of a security misconfiguration.
- ✗
Performing a SQL injection on a web application
Why it's wrong here
Performing a SQL injection on a web application is a classic application-layer vulnerability, not a cloud misconfiguration. While the web application might be hosted in the cloud, SQL injection exploits flaws in the application's code that improperly handle user input, allowing malicious SQL queries to be executed against its database. This attack targets the software logic itself, rather than misconfigured cloud infrastructure services or permissions.
- ✗
Launching a DDoS attack from a botnet
Why it's wrong here
Launching a DDoS attack from a botnet describes an attack method or threat, rather than a cloud misconfiguration that enables exploitation. A Distributed Denial of Service (DDoS) attack aims to overwhelm a target system with traffic, rendering it unavailable, and is typically executed using a network of compromised machines (a botnet). While cloud resources can be targets or sources of DDoS attacks, the attack itself is not a misconfiguration within the cloud environment.
- ✓
Abusing overly permissive IAM roles to escalate privileges
Why this is correct
Abusing overly permissive IAM roles to escalate privileges is a prime example of exploiting a cloud misconfiguration. Identity and Access Management (IAM) roles, when configured with excessive permissions, grant entities more access than necessary to perform their intended functions. An attacker who compromises an entity with such a role can leverage these broad permissions to escalate their privileges, gain control over additional resources, or access sensitive data within the cloud environment.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are cloud-specific security threats?
easy- A.SQL injection
- B.De-authentication attack
- C.ARP spoofing
- ✓ D.S3 bucket misconfiguration
- ✓ E.SSRF in cloud
Why D: S3 bucket misconfiguration is a cloud-specific threat because it involves improper access control settings on Amazon S3 storage, such as public read/write permissions, which can lead to data exposure or unauthorized access. This threat is unique to cloud environments where object storage is managed via APIs and IAM policies, unlike traditional on-premises storage. SSRF (Server-Side Request Forgery) in cloud environments is also cloud-specific because it can be exploited to access sensitive cloud metadata services (e.g., AWS EC2 metadata service, Azure Instance Metadata Service) which provide information like temporary credentials or instance details, a vector unique to cloud infrastructure.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.