CPENT Cloud And Hybrid Infrastructure Security Practice Question
A penetration tester is assessing an AWS environment where an EC2 instance is associated with an IAM role that trusts an external third-party AWS account in its trust policy, but the external account ID was mistyped or left overly broad (e.g., condition missing external ID or using an insecure principal). What vulnerability does this introduce?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The trusted external account can assume the role, and without an ExternalID condition, it is vulnerable to cross-account confusion or unauthorized assumption.
A misconfigured trust policy trusting an external account without a mandatory ExternalID condition exposes the role to the 'Confused Deputy' problem or unauthorized assumption by actors in the trusted account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The EC2 instance is vulnerable to local root privilege escalation via kernel module injection.
Why it's wrong here
Trust policies govern AWS IAM role assumptions, not local kernel security.
- ✗
AWS CloudTrail logs for the instance are permanently deleted.
Why it's wrong here
CloudTrail logs are managed independently in S3 and CloudTrail services.
- ✗
The third-party account gains direct SSH access to the EC2 instance filesystem.
Why it's wrong here
IAM roles do not grant direct SSH access without keys or Session Manager.
- ✓
The trusted external account can assume the role, and without an ExternalID condition, it is vulnerable to cross-account confusion or unauthorized assumption.
Why this is correct
Trust policies without ExternalID conditions risk cross-account security issues.
About these practice questions
This CPENT question is part of Courseiva's 274-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CPENT practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CPENT exam.