Cloud And Hybrid Infrastructure Security

During an Azure penetration test, an attacker identifies an Azure Function with an HTTP trigger that uses function-level keys. However, the function key was leaked in a public GitHub repository. What level of access does this key provide?

An auditor is reviewing an Azure Kubernetes Service (AKS) cluster and discovers that Role-Based Access Control (RBAC) was disabled during cluster creation, and Azure Active Directory integration is not enabled. What is the primary security consequence?

A penetration tester is evaluating a Google Cloud Platform (GCP) environment and discovers a service account key file stored in a public Cloud Storage bucket. The service account has the roles/editor role on the project. What is the most direct way for the tester to leverage this key to gain unauthorized access to the project's resources?

During a penetration test of an Azure Active Directory tenant, an attacker identifies multiple security misconfigurations. Which TWO of the following techniques represent common Azure AD attack vectors or misconfigurations? (Choose TWO)

A penetration tester is analyzing a Kubernetes cluster where pods utilize service accounts with automountServiceAccountToken set to true globally or on sensitive pods. The tester gains remote code execution inside a pod running with a high-privilege service account token. How can they use this token against the Kubernetes API?

During an AWS penetration test, the tester finds an Amazon API Gateway REST API configured with an AWS_IAM authorizer, but one specific method is mistakenly set to 'Authorization: None' (Open API method). What security risk does this introduce?

During an assessment of a Google Cloud Platform (GCP) environment, a penetration tester finds a Compute Engine instance with default service account credentials and scopes set to https://www.googleapis.com/auth/cloud-platform. What security implication does this broad scope present?

A penetration tester is analyzing an Azure environment and discovers that an Azure Function App has been configured with managed identity enabled and possesses 'Contributor' access to the subscription. The function code contains a Server-Side Request Forgery (SSRF) vulnerability. How can the tester exploit the Azure Instance Metadata Service (IMDS) via this SSRF to elevate privileges?

A penetration tester is analyzing a Kubernetes deployment where a ClusterRole grants the verbs get, list, and watch on secrets, combined with a ClusterRoleBinding assigning this to a default service account in a public-facing namespace. How can an external attacker exploit this configuration?

During a penetration test of a Microsoft Azure environment, a tester obtains a managed identity token for a virtual machine. The token has permissions to read secrets from an Azure Key Vault. Which technique can the tester use to escalate privileges by leveraging the Key Vault access?

A security engineer discovers that an AWS IAM user has an active access key and permissions to run ec2:RunInstances, iam:PassRole, and iam:CreateRole. What privilege escalation path does this permission combination represent?

An auditor reviews cloud logging and monitoring configurations across an enterprise multi-cloud environment. Which TWO of the following practices represent critical security deficiencies? (Choose TWO)

A penetration tester is assessing a Microsoft 365 tenant and discovers that a global administrator account has no multi-factor authentication (MFA) enforcement. The tester wants to exploit this to gain persistent access to the tenant's email and files. Which Azure AD feature, if misconfigured, would allow the attacker to maintain access even after the initial password is changed?

A penetration tester is assessing a Microsoft Azure environment and finds that a virtual machine has a system-assigned managed identity. The tester has obtained a shell on the VM and wants to use the managed identity to access an Azure Key Vault. Which endpoint should the tester query to obtain an access token for the Key Vault?

An administrator needs to secure communication between microservices running across different AWS Virtual Private Clouds (VPCs). Which native AWS networking feature provides private connectivity without exposing traffic to the public internet?

An AWS penetration tester uncovers an IAM policy attached to a user that contains the action 'iam:PutUserPolicy' with a resource of '*'. What privilege escalation vector does this enable?

A penetration tester is evaluating a Kubernetes cluster utilizing Role-Based Access Control (RBAC) and notes that a custom role has the create verb on pods/exec resources. What security risk does this specific permission entail?

During an assessment of a Google Cloud Platform project, a penetration tester finds that a Cloud Storage bucket has the allUsers principal granted the Storage Object Viewer role. What security flaw does this represent, and how should it be fixed?

An Azure penetration tester identifies a Virtual Machine with public IP access that has an incoming Network Security Group (NSG) rule allowing TCP port 3389 (RDP) from any source ('Any' or 'Internet'). What is the recommended remediation?

An auditor identifies that an organization's Azure storage account allows anonymous public read access to containers and blobs. What configuration change must be applied to remediate this finding?

An auditor reviews network security configurations in an AWS VPC. Which TWO of the following network configurations represent potential security risks? (Choose TWO)

An auditor reviews an enterprise's hybrid cloud identity architecture. Which TWO of the following configurations represent insecure identity practices? (Choose TWO)

A penetration tester is evaluating a hybrid Active Directory environment. They compromise an on-premises user account that has been synchronized to Azure AD. They discover that the on-premises account is a member of a high-privilege local group, but Azure AD Connect has filtered out this group synchronization. How can the tester leverage Azure AD Connect configuration weaknesses?

An auditor is evaluating cloud storage security across multiple cloud providers. Which TWO of the following settings indicate improper security configurations for cloud storage buckets? (Choose TWO)

A penetration tester is evaluating a Kubernetes environment and discovers that the Kubernetes dashboard is deployed with cluster-admin privileges and is exposed to the internet via a NodePort service without authentication. How can this be exploited?

A penetration tester is auditing an AWS environment and discovers that an IAM role used by an EC2 instance has an overly permissive trust policy allowing any principal in an external AWS account to assume it without specifying an ExternalId. What is the standard security term and remediation for this vulnerability?

An AWS penetration tester discovers that an Amazon RDS database instance has the 'Publicly Accessible' flag set to true, and its security group allows inbound traffic from 0.0.0.0/0 on port 3306. What is the immediate risk, and what is the recommended control?

A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?

During a CPENT engagement against a Microsoft 365 tenant, you obtain a low-privileged user's credentials and successfully authenticate. You need to determine whether the tenant has enabled Security Defaults or configured custom Conditional Access policies, because this affects your ability to perform password spraying and legacy authentication attacks. Which Microsoft Graph endpoint should you query to retrieve the tenant's Conditional Access policy configuration?

During a Kubernetes cluster security assessment, a penetration tester identifies multiple misconfigurations. Which TWO of the following findings represent high-risk security flaws in Kubernetes RBAC and cluster setup? (Choose TWO)

An auditor finds an Amazon S3 bucket configured with public read access enabled via an Access Control List (ACL), but the bucket policy explicitly denies public read access. How does AWS evaluate these conflicting permissions?

When reviewing container security and Kubernetes cluster configurations, which THREE practices or misconfigurations commonly lead to container escapes or host compromise? (Choose three)

An auditor is reviewing an AWS cloud environment and identifies several common misconfigurations related to identity and access management. Which TWO of the following practices represent significant security risks? (Choose TWO)

An attacker gains access to an Azure environment and enumerates App Service Configuration settings. They discover that connection strings and database passwords are stored in plaintext within the application settings rather than being referenced via Azure Key Vault references. What attack path does this enable?

An auditor reviews an Azure storage account and notes that 'Secure transfer required' is set to Disabled. What security risk does this misconfiguration introduce?

In a hybrid enterprise environment, an organization uses Azure AD Seamless Single Sign-On (Seamless SSO). During a penetration test, an attacker compromises a domain-joined workstation and attempts to abuse Seamless SSO. What is the mechanism by which Seamless SSO authenticates users, and what is a known security consideration?

A penetration tester is evaluating an AWS environment and discovers that an IAM role attached to an Amazon EC2 instance has an overly permissive trust policy allowing any user in the account to assume it via the sts:AssumeRole API without external conditions. Which specific remediation step should the cloud administrator apply to fix this risk?

A penetration tester is assessing an AWS environment where an EC2 instance is associated with an IAM role that trusts an external third-party AWS account in its trust policy, but the external account ID was mistyped or left overly broad (e.g., condition missing external ID or using an insecure principal). What vulnerability does this introduce?

During an Azure subscription review, a security assessor checks for role-based access control and resource configuration best practices. Which TWO of the following findings represent high-severity security risks? (Choose TWO)

During an AWS security review, a penetration tester identifies several identity and storage policies. Which TWO of the following configurations are considered insecure? (Choose TWO)

During an Azure assessment, an attacker discovers that an App Service web application has Managed Identity enabled and the underlying application code is vulnerable to Server-Side Request Forgery (SSRF). How can the attacker chain these vulnerabilities?

A CPENT tester is targeting a hybrid cloud environment that uses AWS IAM Identity Center (successor to AWS Single Sign-On) to federate with an on-premises Active Directory. The tester has obtained read-only access to the AWS Organizations management account. Which TWO actions should the tester perform to enumerate potential privilege escalation paths into member accounts? (Choose two.)

A penetration tester is assessing a Microsoft Azure environment and discovers that a virtual machine (VM) has a system-assigned managed identity enabled. The VM is running a web application that is vulnerable to server-side request forgery (SSRF). The tester wants to exploit the SSRF to gain access to Azure resources. Which TWO of the following actions can the tester perform to leverage the managed identity? (Choose two.)